From 9da2a36155d3b96e0dc41cac3dd38f8b6c50efd2 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Mon, 22 Sep 2014 14:57:24 -0400
Subject: stop logging user-agent in apache, fixes #6129

Change-Id: I66384ae4a723be063790362f70e57228a0f1539b
---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb    | 2 ++
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb | 2 ++
 2 files changed, 4 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index 3360ac59..74cd1ced 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -2,12 +2,14 @@
   ServerName <%= api_domain %>
   RewriteEngine On
   RewriteRule ^.*$ https://<%= api_domain -%>:<%= api_port -%>%{REQUEST_URI} [R=permanent,L]
+  CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 </VirtualHost>
 
 Listen 0.0.0.0:<%= api_port %>
 
 <VirtualHost *:<%= api_port -%>>
   ServerName <%= api_domain %>
+  CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 
   SSLEngine on
   SSLProtocol all -SSLv2
diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index ed430510..0e08529c 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -3,12 +3,14 @@
   ServerAlias www.<%= domain %>
   RewriteEngine On
   RewriteRule ^.*$ https://<%= domain -%>%{REQUEST_URI} [R=permanent,L]
+  CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 </VirtualHost>
 
 <VirtualHost *:443>
   ServerName <%= domain_name %>
   ServerAlias <%= domain %>
   ServerAlias www.<%= domain %>
+  CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 
   SSLEngine on
   SSLProtocol all -SSLv2
-- 
cgit v1.2.3


From 308ac3cb420cbce7a6c67e03e887db4723aa8169 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Wed, 24 Sep 2014 13:55:20 +0200
Subject: remove /etc/apt/preferences.d/fixed_rsyslog_anon_package (#6138)

This was a leftover from earlier versions, where we installed rsyslog
from the leap debian package repo.

Change-Id: I88a852f08b5aff3bd7b591b6220ac354463a9786
---
 puppet/modules/site_apt/manifests/preferences/rsyslog.pp | 14 +++++++++-----
 1 file changed, 9 insertions(+), 5 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apt/manifests/preferences/rsyslog.pp b/puppet/modules/site_apt/manifests/preferences/rsyslog.pp
index 132a6e24..bfeaa7da 100644
--- a/puppet/modules/site_apt/manifests/preferences/rsyslog.pp
+++ b/puppet/modules/site_apt/manifests/preferences/rsyslog.pp
@@ -1,9 +1,13 @@
 class site_apt::preferences::rsyslog {
 
-  apt::preferences_snippet { 'rsyslog_anon_depends':
-    package  => 'libestr0 librelp0 rsyslog*',
-    priority => '999',
-    pin      => 'release a=wheezy-backports',
-    before   => Class['rsyslog::install']
+  apt::preferences_snippet {
+    'rsyslog_anon_depends':
+      package  => 'libestr0 librelp0 rsyslog*',
+      priority => '999',
+      pin      => 'release a=wheezy-backports',
+      before   => Class['rsyslog::install'];
+
+    'fixed_rsyslog_anon_package':
+      ensure => absent;
   }
 }
-- 
cgit v1.2.3


From 8f8862aab798cbf0b2dbb690a154cd54dd5d6592 Mon Sep 17 00:00:00 2001
From: irregulator <irregulator@riseup.net>
Date: Thu, 25 Sep 2014 16:46:57 +0300
Subject: Use member function instead of regexp to check services array

---
 puppet/modules/site_obfsproxy/manifests/init.pp | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_obfsproxy/manifests/init.pp b/puppet/modules/site_obfsproxy/manifests/init.pp
index 40b7fba8..6275ebee 100644
--- a/puppet/modules/site_obfsproxy/manifests/init.pp
+++ b/puppet/modules/site_obfsproxy/manifests/init.pp
@@ -11,13 +11,13 @@ class site_obfsproxy {
   $dest_ip      = $obfsproxy['gateway_address']
   $dest_port    = '443'
 
-   if $::services =~ /\bopenvpn\b/ {
-     $openvpn      = hiera('openvpn')
-     $bind_address = $openvpn['gateway_address']
-   }
-   elsif $::services =~ /\bobfsproxy\b/ {
-     $bind_address = hiera('ip_address')
-   }
+  if member($::services, 'openvpn') {
+    $openvpn      = hiera('openvpn')
+    $bind_address = $openvpn['gateway_address']
+  }
+  elsif member($::services, 'obfsproxy') {
+    $bind_address = hiera('ip_address')
+  }
 
   include site_apt::preferences::twisted
   include site_apt::preferences::obfsproxy
-- 
cgit v1.2.3


From 027c20e2b8f779086d1480048152fe06d044b216 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 7 Oct 2014 13:55:58 +0200
Subject: every environment is defined as nagios hostsgroup (#5216)

Change-Id: I6508ce0d06b37a1c5601a0e981a59f7fda47f76a
---
 puppet/modules/site_check_mk/manifests/server.pp         | 13 +++++++++----
 puppet/modules/site_check_mk/templates/hostgroups.mk     |  4 ++++
 puppet/modules/site_nagios/manifests/server.pp           |  9 ++++++---
 puppet/modules/site_nagios/manifests/server/hostgroup.pp |  3 +++
 4 files changed, 22 insertions(+), 7 deletions(-)
 create mode 100644 puppet/modules/site_check_mk/templates/hostgroups.mk
 create mode 100644 puppet/modules/site_nagios/manifests/server/hostgroup.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/manifests/server.pp b/puppet/modules/site_check_mk/manifests/server.pp
index e544ef0d..aa24d96c 100644
--- a/puppet/modules/site_check_mk/manifests/server.pp
+++ b/puppet/modules/site_check_mk/manifests/server.pp
@@ -5,11 +5,12 @@ class site_check_mk::server {
   $type     = $ssh_hash['authorized_keys']['monitor']['type']
   $seckey   = $ssh_hash['monitor']['private_key']
 
-  $nagios_hiera   = hiera_hash('nagios')
-  $nagios_hosts   = $nagios_hiera['hosts']
+  $nagios_hiera     = hiera_hash('nagios')
+  $nagios_hosts     = $nagios_hiera['hosts']
 
-  $hosts          = hiera_hash('hosts')
-  $all_hosts      = inline_template ('<% @hosts.keys.sort.each do |key| -%>"<%= @hosts[key]["domain_internal"] %>", <% end -%>')
+  $hosts            = hiera_hash('hosts')
+  $all_hosts        = inline_template ('<% @hosts.keys.sort.each do |key| -%>"<%= @hosts[key]["domain_internal"] %>", <% end -%>')
+  $domains_internal = $nagios_hiera['domains_internal']
 
   package { 'check-mk-server':
     ensure => installed,
@@ -35,6 +36,10 @@ class site_check_mk::server {
       content => template('site_check_mk/use_ssh.mk'),
       notify  => Exec['check_mk-refresh'],
       require => Package['check-mk-server'];
+    '/etc/check_mk/conf.d/hostgroups.mk':
+      content => template('site_check_mk/hostgroups.mk'),
+      notify  => Exec['check_mk-refresh'],
+      require => Package['check-mk-server'];
     '/etc/check_mk/all_hosts_static':
       content => $all_hosts,
       notify  => Exec['check_mk-refresh'],
diff --git a/puppet/modules/site_check_mk/templates/hostgroups.mk b/puppet/modules/site_check_mk/templates/hostgroups.mk
new file mode 100644
index 00000000..79b7f92f
--- /dev/null
+++ b/puppet/modules/site_check_mk/templates/hostgroups.mk
@@ -0,0 +1,4 @@
+host_groups = [
+  <% @domains_internal.each do |domain| %>( '<%= domain %>', [<% @nagios_hosts.keys.sort.each do |key| -%><% if @nagios_hosts[key]['domain_internal'] == key+'.'+domain -%>'<%= key %>.<%= domain %>', <% end -%><% end -%>] ),
+  <% end -%>
+]
diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index 85443917..8cc1ae24 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -3,9 +3,10 @@ class site_nagios::server inherits nagios::base {
   # First, purge old nagios config (see #1467)
   class { 'site_nagios::server::purge': }
 
-  $nagios_hiera   = hiera('nagios')
-  $nagiosadmin_pw = htpasswd_sha1($nagios_hiera['nagiosadmin_pw'])
-  $nagios_hosts   = $nagios_hiera['hosts']
+  $nagios_hiera     = hiera('nagios')
+  $nagiosadmin_pw   = htpasswd_sha1($nagios_hiera['nagiosadmin_pw'])
+  $nagios_hosts     = $nagios_hiera['hosts']
+  $domains_internal = $nagios_hiera['domains_internal']
 
   include nagios::defaults
   include nagios::base
@@ -55,4 +56,6 @@ class site_nagios::server inherits nagios::base {
         'set missingok missingok', 'set ifempty notifempty',
         'set copytruncate copytruncate' ]
   }
+
+  ::site_nagios::server::hostgroup { $domains_internal: }
 }
diff --git a/puppet/modules/site_nagios/manifests/server/hostgroup.pp b/puppet/modules/site_nagios/manifests/server/hostgroup.pp
new file mode 100644
index 00000000..035ba7d1
--- /dev/null
+++ b/puppet/modules/site_nagios/manifests/server/hostgroup.pp
@@ -0,0 +1,3 @@
+define site_nagios::server::hostgroup {
+  nagios_hostgroup { $name: }
+}
-- 
cgit v1.2.3


From 36a1332f5f6e43591a47b89ec505541f84381667 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Tue, 7 Oct 2014 14:16:54 +0200
Subject: include different nagios::defaults classes manually (#5216)

nagios::defaults will include nagios::defaults::hostgroups which
add "all" and "centos_servers" hostgroups which we don't want.

Change-Id: If42faa11c167fb7305ebbb21dc358a8813afaa25
---
 puppet/modules/site_nagios/manifests/server.pp | 8 +++++++-
 1 file changed, 7 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_nagios/manifests/server.pp b/puppet/modules/site_nagios/manifests/server.pp
index 8cc1ae24..b195c880 100644
--- a/puppet/modules/site_nagios/manifests/server.pp
+++ b/puppet/modules/site_nagios/manifests/server.pp
@@ -8,8 +8,14 @@ class site_nagios::server inherits nagios::base {
   $nagios_hosts     = $nagios_hiera['hosts']
   $domains_internal = $nagios_hiera['domains_internal']
 
-  include nagios::defaults
   include nagios::base
+  include nagios::defaults::commands
+  include nagios::defaults::contactgroups
+  include nagios::defaults::contacts
+  include nagios::defaults::templates
+  include nagios::defaults::timeperiods
+  include nagios::defaults::plugins
+
   class {'nagios':
     # don't manage apache class from nagios, cause we already include
     # it in site_apache::common
-- 
cgit v1.2.3


From 189bd4b704ba685640ca01afe90f592e7b33567a Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Wed, 15 Oct 2014 17:07:45 -0400
Subject: Disable SSLv3, and RC4 ciphers

Change-Id: I7214aa4334e3d817dd1b6d8dce43523e3d955b5d
---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb         | 4 ++--
 puppet/modules/site_apache/templates/vhosts.d/common.conf.erb      | 4 ++--
 puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb | 5 +++--
 puppet/modules/site_static/templates/apache.conf.erb               | 4 ++--
 4 files changed, 9 insertions(+), 8 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index 74cd1ced..e4732289 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -12,10 +12,10 @@ Listen 0.0.0.0:<%= api_port %>
   CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 
   SSLEngine on
-  SSLProtocol all -SSLv2
+  SSLProtocol all -SSLv2 -SSLv3
   SSLHonorCipherOrder on
   SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
+  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
 
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
diff --git a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
index 0e08529c..a9733a97 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/common.conf.erb
@@ -13,10 +13,10 @@
   CustomLog ${APACHE_LOG_DIR}/other_vhosts_access.log common
 
   SSLEngine on
-  SSLProtocol all -SSLv2
+  SSLProtocol all -SSLv2 -SSLv3
   SSLHonorCipherOrder on
   SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
+  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
 
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::commercial_ca_name') %>.crt
diff --git a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
index ae06410e..56a8d9f6 100644
--- a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
+++ b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
@@ -9,9 +9,10 @@ Listen 0.0.0.0:<%= @nickserver_port -%>
   ServerAlias <%= @address_domain %>
 
   SSLEngine on
-  SSLProtocol -all +SSLv3 +TLSv1
-  SSLCipherSuite HIGH:MEDIUM:!aNULL:!SSLv2:!MD5:@STRENGTH
+  SSLProtocol all -SSLv2 -SSLv3
   SSLHonorCipherOrder on
+  SSLCompression off
+  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
 
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
diff --git a/puppet/modules/site_static/templates/apache.conf.erb b/puppet/modules/site_static/templates/apache.conf.erb
index 07ac481d..9b516a10 100644
--- a/puppet/modules/site_static/templates/apache.conf.erb
+++ b/puppet/modules/site_static/templates/apache.conf.erb
@@ -46,10 +46,10 @@
   #RewriteLogLevel 3
 
   SSLEngine on
-  SSLProtocol all -SSLv2
+  SSLProtocol all -SSLv2 -SSLv3
   SSLHonorCipherOrder on
   SSLCompression off
-  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:ECDHE-RSA-RC4-SHA:ECDHE-ECDSA-RC4-SHA:AES128:AES256:RC4-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
+  SSLCipherSuite "ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128:AES256:HIGH:!aNULL:!eNULL:!EXPORT:!DES:!3DES:!MD5:!PSK"
 
 <%- if @tls_only -%>
   Header add Strict-Transport-Security: "max-age=15768000;includeSubdomains"
-- 
cgit v1.2.3


From f6ffad33042aa6580ec00ef23836291861c1ae17 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Mon, 20 Oct 2014 21:44:37 -0400
Subject: implement custom puppet support (#6201, #6226)

change puppet command to include in the --modulepath
/srv/leap/files/puppet/modules

If a provider places puppet code under files/puppet it will
be sync'd over to all the nodes, once leap cli #6225 is merged.

The custom puppet entry point is in class 'custom' which can
be put into files/puppet/modules/custom/manifests/init.pp

Change-Id: I74879c6ee056b03cd4691aa81a7668b60383bdad
---
 puppet/modules/site_config/manifests/default.pp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index fc2179de..790b5a16 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -59,10 +59,10 @@ class site_config::default {
     include site_postfix::satellite
   }
 
-  # if class site_custom exists, include it.
+  # if class custom exists, include it.
   # possibility for users to define custom puppet recipes
-  if defined( '::site_custom') {
-    include ::site_custom
+  if defined( '::custom') {
+    include ::custom
   }
 
   include site_check_mk::agent
-- 
cgit v1.2.3


From b76445c07688ba1b4e8940189f8538a741de92d4 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 21 Oct 2014 20:27:06 -0400
Subject: modify the leap repository contents so they pick the correct
 repository, based on the hiera value 'major_version' (#6251)

Change-Id: I10532ef83e3aa2d35d9c0be241952a35e366bba4
---
 puppet/modules/site_apt/manifests/leap_repo.pp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apt/manifests/leap_repo.pp b/puppet/modules/site_apt/manifests/leap_repo.pp
index 6b3d9919..2d4ba0e1 100644
--- a/puppet/modules/site_apt/manifests/leap_repo.pp
+++ b/puppet/modules/site_apt/manifests/leap_repo.pp
@@ -1,6 +1,9 @@
 class site_apt::leap_repo {
+  $platform = hiera_hash('platform')
+  $major_version = $platform['major_version']
+
   apt::sources_list { 'leap.list':
-    content => 'deb http://deb.leap.se/debian stable main',
+    content => "deb http://deb.leap.se/${major_version} wheezy main\n",
     before  => Exec[refresh_apt]
   }
 
-- 
cgit v1.2.3


From 937c61b74bbd99f9955cbee426fb35e96050eea6 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Mon, 27 Oct 2014 09:23:23 -0400
Subject: Change stunnel default sslversion to be TLSv1, instead of the default
 SSLv3 (#6261)

Change-Id: I7ab5a6455e434f8359169d31febed8b92f84bbcc
---
 puppet/modules/site_stunnel/manifests/client.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index 12d664b4..76815174 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -35,6 +35,7 @@ define site_stunnel::client (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => $rndfile,
     debuglevel => $debuglevel,
+    sslversion => 'TLSv1',
     subscribe  => [
       Class['Site_config::X509::Key'],
       Class['Site_config::X509::Cert'],
-- 
cgit v1.2.3


From f14cfe9601ab60b30af7baf126cb223eacec3593 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 28 Oct 2014 12:18:27 -0400
Subject: upgrade unattended-upgrades on deploy (#6245)

unattended-upgrades is not able to upgrade itself in certain situations,
such as when the conffile prompt is generated due to the config being
changed. We want to set this package as latest in the platform so that
it is upgraded on every deploy (we deploy the config anyway).

Change-Id: I8c99bfb1b001079f0e1a4ffbf048e0e867633335
---
 puppet/modules/site_apt/manifests/init.pp                |  4 ++--
 puppet/modules/site_apt/manifests/unattended_upgrades.pp | 10 ++++++++++
 2 files changed, 12 insertions(+), 2 deletions(-)
 create mode 100644 puppet/modules/site_apt/manifests/unattended_upgrades.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apt/manifests/init.pp b/puppet/modules/site_apt/manifests/init.pp
index 9facf4cc..633ccf1e 100644
--- a/puppet/modules/site_apt/manifests/init.pp
+++ b/puppet/modules/site_apt/manifests/init.pp
@@ -1,4 +1,4 @@
-class site_apt  {
+class site_apt {
 
   class { 'apt':
     custom_key_dir     => 'puppet:///modules/site_apt/keys'
@@ -11,7 +11,7 @@ class site_apt  {
     content => 'Acquire::PDiffs "false";';
   }
 
-  include ::apt::unattended_upgrades
+  include ::site_apt::unattended_upgrades
 
   apt::sources_list { 'secondary.list.disabled':
     content => template('site_apt/secondary.list');
diff --git a/puppet/modules/site_apt/manifests/unattended_upgrades.pp b/puppet/modules/site_apt/manifests/unattended_upgrades.pp
new file mode 100644
index 00000000..daebffab
--- /dev/null
+++ b/puppet/modules/site_apt/manifests/unattended_upgrades.pp
@@ -0,0 +1,10 @@
+class site_apt::unattended_upgrades inherits apt::unattended_upgrades {
+  # override unattended-upgrades package resource to make sure
+  # that it is upgraded on every deploy (#6245)
+
+  include ::apt::unattended_upgrades
+
+  Package['unattended-upgrades'] {
+    ensure => latest
+  }
+}
-- 
cgit v1.2.3


From d3e24760b33d6ae20f153d3c144d7d443fb0b69e Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Wed, 29 Oct 2014 15:20:54 -0700
Subject: added webapp.forbidden_usernames property to allow configuration of
 usernames to block.

---
 puppet/modules/site_webapp/templates/config.yml.erb | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/templates/config.yml.erb b/puppet/modules/site_webapp/templates/config.yml.erb
index 9205438b..0c75f3ca 100644
--- a/puppet/modules/site_webapp/templates/config.yml.erb
+++ b/puppet/modules/site_webapp/templates/config.yml.erb
@@ -19,6 +19,7 @@ production:
   default_service_level: "<%= @webapp['default_service_level'] %>"
   service_levels: <%= @webapp['service_levels'].to_json %>
   allow_registration: <%= @webapp['allow_registration'].inspect %>
+  handle_blacklist: <%= @webapp['forbidden_usernames'].inspect %>
 <%- if @webapp['engines'] && @webapp['engines'].any? -%>
   engines:
 <%-   @webapp['engines'].each do |engine| -%>
-- 
cgit v1.2.3


From 84957fbd0f1e4aa26303b6488d9ec7df8af08ab7 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Fri, 31 Oct 2014 13:15:13 -0400
Subject: Fix deprecated dynamic lookups of variables in site_couchdb (#6286)

Change-Id: I318944a6872a53ff9c533704514da339426d9401
---
 puppet/modules/site_couchdb/manifests/bigcouch.pp | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/manifests/bigcouch.pp b/puppet/modules/site_couchdb/manifests/bigcouch.pp
index f0aab734..e3cba4ba 100644
--- a/puppet/modules/site_couchdb/manifests/bigcouch.pp
+++ b/puppet/modules/site_couchdb/manifests/bigcouch.pp
@@ -1,12 +1,12 @@
 class site_couchdb::bigcouch {
 
-  $config         = $couchdb_config['bigcouch']
+  $config         = $::site_couchdb::couchdb_config['bigcouch']
   $cookie         = $config['cookie']
   $ednp_port      = $config['ednp_port']
 
   class { 'couchdb':
-    admin_pw            => $couchdb_admin_pw,
-    admin_salt          => $couchdb_admin_salt,
+    admin_pw            => $::site_couchdb::couchdb_admin_pw,
+    admin_salt          => $::site_couchdb::couchdb_admin_salt,
     bigcouch            => true,
     bigcouch_cookie     => $cookie,
     ednp_port           => $ednp_port,
-- 
cgit v1.2.3


From 5787c97b6f73dacae7f01adeff203287007c381d Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sat, 1 Nov 2014 10:36:48 -0400
Subject: stop using bad nist curve for ssh host key (#6294)

update port parameter in site_sshd to be an array, otherwise
puppet errors about it being a Fixnum with new sshd module

Change-Id: I854d042edb98817169eef5e758d04d60d3c71dd5
---
 puppet/modules/site_sshd/manifests/init.pp | 2 +-
 puppet/modules/sshd                        | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_sshd/manifests/init.pp b/puppet/modules/site_sshd/manifests/init.pp
index 9a05b6ed..1da2f1d5 100644
--- a/puppet/modules/site_sshd/manifests/init.pp
+++ b/puppet/modules/site_sshd/manifests/init.pp
@@ -53,7 +53,7 @@ class site_sshd {
   ##
   class { '::sshd':
     manage_nagios => false,
-    ports         => $ssh['port'],
+    ports         => [ $ssh['port'] ],
     use_pam       => 'yes',
     hardened_ssl  => 'yes',
     print_motd    => 'no',
diff --git a/puppet/modules/sshd b/puppet/modules/sshd
index 5c23b332..4652fbca 160000
--- a/puppet/modules/sshd
+++ b/puppet/modules/sshd
@@ -1 +1 @@
-Subproject commit 5c23b33200fc6229ada7f4e13672b5da0d4bdd8e
+Subproject commit 4652fbcae0aadcded5d390e71882aec1b1b738ba
-- 
cgit v1.2.3


From 38d7c80fae4efc1d365ec9f982cb025dc67a4386 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sun, 2 Nov 2014 20:53:34 -0500
Subject: add missing TLSv1 sslversion parameter to site_stunnel::serviers

Change-Id: I48dc8135943393bd11c7181853985f4a5799011e
---
 puppet/modules/site_stunnel/manifests/servers.pp | 1 +
 1 file changed, 1 insertion(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_stunnel/manifests/servers.pp b/puppet/modules/site_stunnel/manifests/servers.pp
index b1da5c59..8d537644 100644
--- a/puppet/modules/site_stunnel/manifests/servers.pp
+++ b/puppet/modules/site_stunnel/manifests/servers.pp
@@ -35,6 +35,7 @@ define site_stunnel::servers (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => $debuglevel,
+    sslversion => 'TLSv1',
     require    => [
       Class['Site_config::X509::Key'],
       Class['Site_config::X509::Cert'],
-- 
cgit v1.2.3


From 18f5d6ea49446f214cbb764ea223f427aafd641e Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sun, 2 Nov 2014 21:47:36 -0500
Subject: change ordering hints to use refresh_stunnel exec instead of service
 (#6287)

In a multi-node couch deployment, it was observed that the Service['stunnel']
would be activated, and then later a stunnel::client was created which would
trigger an Exec['refresh_stunnel']. Because of this, and the ordering hints
that were in place, the service would get started, and then the couchdb
databases, users, designs, etc. were being put into place and then a stunnel
client was created, triggering the refresh_stunnel exec, which would cause
an interruption in the connectivity and result in failures.

This change replaces the Service['stunnel'] hint with the the
Exec['refresh_stunnel'] to make sure that the stunnels are fully setup before
attempting couch operations.

Change-Id: I33ddd24884b3c23a1df5555ca53ca65cd703da50
---
 puppet/modules/couchdb                            | 2 +-
 puppet/modules/site_couchdb/manifests/bigcouch.pp | 2 +-
 puppet/modules/site_couchdb/manifests/init.pp     | 8 ++++----
 3 files changed, 6 insertions(+), 6 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/couchdb b/puppet/modules/couchdb
index f01b3586..4c0d5673 160000
--- a/puppet/modules/couchdb
+++ b/puppet/modules/couchdb
@@ -1 +1 @@
-Subproject commit f01b3586215bdc10f0067fa0f6d940be8e88bcea
+Subproject commit 4c0d5673df02fe42e1bbadfee7d4ea1ca1f88e98
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch.pp b/puppet/modules/site_couchdb/manifests/bigcouch.pp
index e3cba4ba..d71c00c5 100644
--- a/puppet/modules/site_couchdb/manifests/bigcouch.pp
+++ b/puppet/modules/site_couchdb/manifests/bigcouch.pp
@@ -19,7 +19,7 @@ class site_couchdb::bigcouch {
   Class['site_config::default']
     -> Class['couchdb::bigcouch::package::cloudant']
     -> Service['shorewall']
-    -> Service['stunnel']
+    -> Exec['refresh_stunnel']
     -> Class['site_couchdb::setup']
     -> Class['site_couchdb::bigcouch::add_nodes']
     -> Class['site_couchdb::bigcouch::settle_cluster']
diff --git a/puppet/modules/site_couchdb/manifests/init.pp b/puppet/modules/site_couchdb/manifests/init.pp
index 5a4fb936..a11f6309 100644
--- a/puppet/modules/site_couchdb/manifests/init.pp
+++ b/puppet/modules/site_couchdb/manifests/init.pp
@@ -42,13 +42,13 @@ class site_couchdb {
   $couchdb_backup           = $couchdb_config['backup']
   $couchdb_mode             = $couchdb_config['mode']
 
-  if $couchdb_mode == "multimaster" { include site_couchdb::bigcouch }
-  if $couchdb_mode == "master"      { include site_couchdb::master }
-  if $couchdb_mode == "mirror"      { include site_couchdb::mirror }
+  if $couchdb_mode == 'multimaster' { include site_couchdb::bigcouch }
+  if $couchdb_mode == 'master'      { include site_couchdb::master }
+  if $couchdb_mode == 'mirror'      { include site_couchdb::mirror }
 
   Class['site_config::default']
     -> Service['shorewall']
-    -> Service['stunnel']
+    -> Exec['refresh_stunnel']
     -> Class['couchdb']
     -> Class['site_couchdb::setup']
 
-- 
cgit v1.2.3


From c150fa3eb79d822850205c0178de9bb5f422ae01 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 4 Nov 2014 11:34:42 -0500
Subject: add local 50unattended-upgrades to fix unattended-upgrades not
 upgrading leap packages (#4425)

Change-Id: I78c00c4410ff9f712206f95854d8803e43acb286
---
 .../modules/site_apt/files/Debian/50unattended-upgrades  | 16 ++++++++++++++++
 1 file changed, 16 insertions(+)
 create mode 100644 puppet/modules/site_apt/files/Debian/50unattended-upgrades

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apt/files/Debian/50unattended-upgrades b/puppet/modules/site_apt/files/Debian/50unattended-upgrades
new file mode 100644
index 00000000..f2f574fc
--- /dev/null
+++ b/puppet/modules/site_apt/files/Debian/50unattended-upgrades
@@ -0,0 +1,16 @@
+// this file is managed by puppet !
+
+Unattended-Upgrade::Allowed-Origins {
+        "${distro_id}:stable";
+        "${distro_id}:${distro_codename}-security";
+        "${distro_id}:${distro_codename}-updates";
+        "${distro_id} Backports:${distro_codename}-backports";
+        "leap.se:stable";
+};
+
+APT::Periodic::Update-Package-Lists "1";
+APT::Periodic::Download-Upgradeable-Packages "1";
+APT::Periodic::Unattended-Upgrade "1";
+
+Unattended-Upgrade::Mail "root";
+Unattended-Upgrade::MailOnlyOnError "true";
-- 
cgit v1.2.3


From 16c985a1b8e692c0e0f76a30b7ec052c9dc269bd Mon Sep 17 00:00:00 2001
From: guido <guido@bruo.org>
Date: Tue, 28 Oct 2014 21:03:52 -0300
Subject: Adds support for Tor hidden service on webapp (Feature #6273)

Change-Id: I56250e05e3a933deacd0b6e02192e712d3fd9fd5
---
 .../templates/vhosts.d/hidden_service.conf.erb     | 33 +++++++++++++++++
 .../site_webapp/manifests/hidden_service.pp        | 43 ++++++++++++++++++++++
 puppet/modules/site_webapp/manifests/init.pp       |  6 +++
 3 files changed, 82 insertions(+)
 create mode 100644 puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
 create mode 100644 puppet/modules/site_webapp/manifests/hidden_service.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
new file mode 100644
index 00000000..0c6f3b8e
--- /dev/null
+++ b/puppet/modules/site_apache/templates/vhosts.d/hidden_service.conf.erb
@@ -0,0 +1,33 @@
+<VirtualHost 127.0.0.1:80>
+  ServerName <%= tor_domain %>
+
+  <IfModule mod_headers.c>
+    Header always unset X-Powered-By
+    Header always unset X-Runtime
+  </IfModule>
+
+<% if (defined? @services) and (@services.include? 'webapp') -%>
+  DocumentRoot /srv/leap/webapp/public
+
+  RewriteEngine On
+  # Check for maintenance file and redirect all requests
+  RewriteCond %{DOCUMENT_ROOT}/system/maintenance.html -f
+  RewriteCond %{SCRIPT_FILENAME} !maintenance.html
+  RewriteCond %{REQUEST_URI} !/images/maintenance.jpg
+  RewriteRule ^.*$ %{DOCUMENT_ROOT}/system/maintenance.html [L]
+
+  # http://www.modrails.com/documentation/Users%20guide%20Apache.html#_passengerallowencodedslashes_lt_on_off_gt
+  AllowEncodedSlashes on
+  PassengerAllowEncodedSlashes on
+  PassengerFriendlyErrorPages off
+  SetEnv TMPDIR /var/tmp
+
+  # Allow rails assets to be cached for a very long time (since the URLs change whenever the content changes)
+  <Location /assets/>
+    Header unset ETag
+    FileETag None
+    ExpiresActive On
+    ExpiresDefault "access plus 1 year"
+  </Location>
+<% end -%>
+</VirtualHost>
diff --git a/puppet/modules/site_webapp/manifests/hidden_service.pp b/puppet/modules/site_webapp/manifests/hidden_service.pp
new file mode 100644
index 00000000..ac0e8a37
--- /dev/null
+++ b/puppet/modules/site_webapp/manifests/hidden_service.pp
@@ -0,0 +1,43 @@
+class site_webapp::hidden_service {
+  $tor              = hiera('tor')
+  $hidden_service   = $tor['hidden_service']
+  $tor_domain       = "${hidden_service['address']}.onion"
+
+  include site_apache::common
+  include site_apache::module::headers
+  include site_apache::module::alias
+  include site_apache::module::expires
+  include site_apache::module::removeip
+
+  include tor::daemon
+  tor::daemon::hidden_service { 'webapp': ports => '80 127.0.0.1:80' }
+
+  file {
+    '/var/lib/tor/webapp/':
+      ensure  => directory,
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '2700';
+
+    '/var/lib/tor/webapp/private_key':
+      ensure  => present,
+      source  => '/srv/leap/files/nodes/web/tor.key',
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '0600';
+
+    '/var/lib/tor/webapp/hostname':
+      ensure  => present,
+      content => $tor_domain,
+      owner   => 'debian-tor',
+      group   => 'debian-tor',
+      mode    => '0600';
+  }
+
+  apache::vhost::file {
+    'hidden_service':
+      content => template('site_apache/vhosts.d/hidden_service.conf.erb')
+  }
+
+  include site_shorewall::tor
+}
\ No newline at end of file
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 17b010f3..12c69a39 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -10,6 +10,8 @@ class site_webapp {
   $webapp           = hiera('webapp')
   $api_version      = $webapp['api_version']
   $secret_token     = $webapp['secret_token']
+  $tor              = hiera('tor')
+  $hidden_service   = $tor['hidden_service']
 
   Class['site_config::default'] -> Class['site_webapp']
 
@@ -157,6 +159,10 @@ class site_webapp {
       notify  => Service['apache'];
   }
 
+  if $hidden_service['active'] {
+    include site_webapp::hidden_service
+  }
+
   include site_shorewall::webapp
   include site_check_mk::agent::webapp
 }
-- 
cgit v1.2.3


From d0658888a0af6b06b03fd172306ea3f346c50081 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Tue, 4 Nov 2014 20:45:39 -0500
Subject: revert 5787c97b6f73dacae7f01adeff203287007c381d: stop using bad nist
 curve for ssh host key (#6294)

We need to transition smoother (see #6319)

Change-Id: I8bee032aef9502a7d4b701b99719fbfb3b7169da
---
 puppet/modules/sshd | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/sshd b/puppet/modules/sshd
index 4652fbca..750a4977 160000
--- a/puppet/modules/sshd
+++ b/puppet/modules/sshd
@@ -1 +1 @@
-Subproject commit 4652fbcae0aadcded5d390e71882aec1b1b738ba
+Subproject commit 750a497758d94c2f5a6cad23cecc3dbde2d2f92f
-- 
cgit v1.2.3


From 3ec9b173c092f1b582285c3e3573259d289c400e Mon Sep 17 00:00:00 2001
From: guido <guido@bruo.org>
Date: Thu, 6 Nov 2014 12:45:32 -0300
Subject: Better check for tor hidden service on a webapp node.

Change-Id: I92f69b6fa30aae953243ae19096e2998810c9ac6
---
 puppet/modules/site_webapp/manifests/init.pp | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 12c69a39..752993c1 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -10,8 +10,7 @@ class site_webapp {
   $webapp           = hiera('webapp')
   $api_version      = $webapp['api_version']
   $secret_token     = $webapp['secret_token']
-  $tor              = hiera('tor')
-  $hidden_service   = $tor['hidden_service']
+  $tor              = hiera('tor', false)
 
   Class['site_config::default'] -> Class['site_webapp']
 
@@ -159,8 +158,11 @@ class site_webapp {
       notify  => Service['apache'];
   }
 
-  if $hidden_service['active'] {
-    include site_webapp::hidden_service
+  if $tor {
+    $hidden_service = $tor['hidden_service']
+    if $hidden_service['active'] {
+      include site_webapp::hidden_service
+    }
   }
 
   include site_shorewall::webapp
-- 
cgit v1.2.3


From 180f32512a4c47444ea9e4f36d7376a894a83a4b Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sat, 8 Nov 2014 00:44:30 -0500
Subject: Don't configure the tor DirPort options if the node is not an exit
 (#6335)

Change-Id: I4c7fb20b6da6f6a5bb2dd5af70511a28d4581174
---
 puppet/modules/site_tor/manifests/init.pp | 4 ----
 1 file changed, 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_tor/manifests/init.pp b/puppet/modules/site_tor/manifests/init.pp
index e62cb12d..58f9e971 100644
--- a/puppet/modules/site_tor/manifests/init.pp
+++ b/puppet/modules/site_tor/manifests/init.pp
@@ -24,10 +24,6 @@ class site_tor {
     tor::daemon::directory { $::hostname: port => 80 }
   }
   else {
-    tor::daemon::directory { $::hostname:
-      port            => 80,
-      port_front_page => '';
-    }
     include site_tor::disable_exit
   }
 
-- 
cgit v1.2.3


From fe23f66f0cff5af71c10aeefdbb0b1131d871219 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sat, 8 Nov 2014 00:45:14 -0500
Subject: Only enable the tor DirPort options on an exit if the node isn't also
 a webapp node (#6336)

Change-Id: Ib70bbd8fe7b94b7a1bfb09390d5dd1c535f2da16
---
 puppet/modules/site_tor/manifests/init.pp | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_tor/manifests/init.pp b/puppet/modules/site_tor/manifests/init.pp
index 58f9e971..8f68a4e4 100644
--- a/puppet/modules/site_tor/manifests/init.pp
+++ b/puppet/modules/site_tor/manifests/init.pp
@@ -21,7 +21,10 @@ class site_tor {
   }
 
   if ( $tor_type == 'exit'){
-    tor::daemon::directory { $::hostname: port => 80 }
+    # Only enable the daemon directory if the node isn't also a webapp node
+    if ! member($::services, 'webapp') {
+      tor::daemon::directory { $::hostname: port => 80 }
+    }
   }
   else {
     include site_tor::disable_exit
-- 
cgit v1.2.3


From 51d581583ca354232f6ccbfb771c1cad00ec2db3 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sat, 8 Nov 2014 00:46:00 -0500
Subject: minor linting, arrow lining up

Change-Id: Ibd08529b7d1c4fc22bcd0ca36e518afa5b8f6d24
---
 puppet/modules/site_tor/manifests/init.pp | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_tor/manifests/init.pp b/puppet/modules/site_tor/manifests/init.pp
index 8f68a4e4..9944bb2b 100644
--- a/puppet/modules/site_tor/manifests/init.pp
+++ b/puppet/modules/site_tor/manifests/init.pp
@@ -13,11 +13,11 @@ class site_tor {
 
   class { 'tor::daemon': }
   tor::daemon::relay { $nickname:
-    port             => 9001,
-    address          => $address,
-    contact_info     => obfuscate_email($contact_emails),
-    bandwidth_rate   => $bandwidth_rate,
-    my_family        => $family
+    port           => 9001,
+    address        => $address,
+    contact_info   => obfuscate_email($contact_emails),
+    bandwidth_rate => $bandwidth_rate,
+    my_family      => $family
   }
 
   if ( $tor_type == 'exit'){
-- 
cgit v1.2.3


From b9d2030beb890e8dccbbe42bfcc430a2c2702a92 Mon Sep 17 00:00:00 2001
From: elijah <elijah@riseup.net>
Date: Mon, 10 Nov 2014 20:43:24 -0800
Subject: openvpn - support customizing --fragment, and set default to 1400

---
 puppet/modules/site_openvpn/manifests/server_config.pp | 12 ++++++++++++
 1 file changed, 12 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 97cf2842..466f6d00 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -85,6 +85,18 @@ define site_openvpn::server_config(
         key     => 'tcp-nodelay',
         server  => $openvpn_configname;
     }
+  } elsif $proto == 'udp' {
+    if $config['fragment'] != 1500 {
+      openvpn::option {
+        "fragment ${openvpn_configname}":
+          key    => 'fragment',
+          value  => $config['fragment'],
+          server => $openvpn_configname;
+        "mssfix ${openvpn_configname}":
+          key    => 'mssfix',
+          server => $openvpn_configname;
+      }
+    }
   }
 
   openvpn::option {
-- 
cgit v1.2.3


From 7521958cc6c210d65009aa87c6c7297fd9be3dd2 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sat, 15 Nov 2014 13:36:51 -0500
Subject: don't enable Tor DirPort if openvpn is running on port 80 (Bug #6377)

We need to check the openvpn hiera value, which may or may not be set.
If it is not set, then we need to not lookup the $openvpn['ports]'
values or we will get an error because it wont be the correct type.

If we do have it, then $openvpn_ports gets set with the hash, otherwise
it gets set to an empty hash (otherwise puppet will complain when we try
to query the member() later with "member(): Requires array to work
with").

Finally, if it is set to port 80, we don't include the
tor::daemon::directory

Change-Id: Ic366c72e966cae9d611e8fe5aa7ea7943be51241
---
 puppet/modules/site_tor/manifests/init.pp | 11 ++++++++++-
 1 file changed, 10 insertions(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_tor/manifests/init.pp b/puppet/modules/site_tor/manifests/init.pp
index 9944bb2b..d14e813d 100644
--- a/puppet/modules/site_tor/manifests/init.pp
+++ b/puppet/modules/site_tor/manifests/init.pp
@@ -11,6 +11,14 @@ class site_tor {
 
   $address        = hiera('ip_address')
 
+  $openvpn        = hiera('openvpn', undef)
+  if $openvpn {
+    $openvpn_ports = $openvpn['ports']
+  }
+  else {
+    $openvpn_ports = []
+  }
+  
   class { 'tor::daemon': }
   tor::daemon::relay { $nickname:
     port           => 9001,
@@ -22,7 +30,8 @@ class site_tor {
 
   if ( $tor_type == 'exit'){
     # Only enable the daemon directory if the node isn't also a webapp node
-    if ! member($::services, 'webapp') {
+    # or running openvpn on port 80
+    if ! member($::services, 'webapp') and ! member($openvpn_ports, '80') {
       tor::daemon::directory { $::hostname: port => 80 }
     }
   }
-- 
cgit v1.2.3


From be18ba31fadd2e587672adc44175dd106187ceba Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 20 Nov 2014 13:13:33 -0500
Subject: minor linting

Change-Id: I6d04cc7e028e86ee0012d96d7ef075fdd7ecef19
---
 puppet/modules/site_shorewall/manifests/dnat_rule.pp | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
index aa298408..49b929f2 100644
--- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp
+++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
@@ -4,7 +4,7 @@ define site_shorewall::dnat_rule {
   if $port != 1194 {
     if $site_openvpn::openvpn_allow_unlimited {
       shorewall::rule {
-          "dnat_tcp_port_$port":
+          "dnat_tcp_port_${port}":
             action          => 'DNAT',
             source          => 'net',
             destination     => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
@@ -13,7 +13,7 @@ define site_shorewall::dnat_rule {
             order           => 100;
       }
       shorewall::rule {
-          "dnat_udp_port_$port":
+          "dnat_udp_port_${port}":
             action          => 'DNAT',
             source          => 'net',
             destination     => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
@@ -24,7 +24,7 @@ define site_shorewall::dnat_rule {
     }
     if $site_openvpn::openvpn_allow_limited {
       shorewall::rule {
-          "dnat_free_tcp_port_$port":
+          "dnat_free_tcp_port_${port}":
             action          => 'DNAT',
             source          => 'net',
             destination     => "\$FW:${site_openvpn::limited_gateway_address}:1194",
@@ -33,7 +33,7 @@ define site_shorewall::dnat_rule {
             order           => 100;
       }
       shorewall::rule {
-          "dnat_free_udp_port_$port":
+          "dnat_free_udp_port_${port}":
             action          => 'DNAT',
             source          => 'net',
             destination     => "\$FW:${site_openvpn::limited_gateway_address}:1194",
-- 
cgit v1.2.3


From e334f10447303209ac3802436437670f45511603 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 20 Nov 2014 13:13:55 -0500
Subject: specify the destination IP for DNAT rules for gateway addresses on
 port 443 (#6388)

Previously the DNAT rule would redirect the incoming port 443 requests
to openvpn, which was the wrong thing to do on the primary IP (but the
right thing to do on the openvpn gateway IPs). This manifested in the
webapp not being available when it was also configured as a service on
the node.

Change-Id: Ic8c6b6c0389859fab168a7df687351e11263277a
---
 puppet/modules/site_shorewall/manifests/dnat_rule.pp | 4 ++++
 1 file changed, 4 insertions(+)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_shorewall/manifests/dnat_rule.pp b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
index 49b929f2..f9fbe950 100644
--- a/puppet/modules/site_shorewall/manifests/dnat_rule.pp
+++ b/puppet/modules/site_shorewall/manifests/dnat_rule.pp
@@ -10,6 +10,7 @@ define site_shorewall::dnat_rule {
             destination     => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
             proto           => 'tcp',
             destinationport => $port,
+            originaldest    => $site_openvpn::unlimited_gateway_address,
             order           => 100;
       }
       shorewall::rule {
@@ -19,6 +20,7 @@ define site_shorewall::dnat_rule {
             destination     => "\$FW:${site_openvpn::unlimited_gateway_address}:1194",
             proto           => 'udp',
             destinationport => $port,
+            originaldest    => $site_openvpn::unlimited_gateway_address,
             order           => 100;
       }
     }
@@ -30,6 +32,7 @@ define site_shorewall::dnat_rule {
             destination     => "\$FW:${site_openvpn::limited_gateway_address}:1194",
             proto           => 'tcp',
             destinationport => $port,
+            originaldest    => $site_openvpn::unlimited_gateway_address,
             order           => 100;
       }
       shorewall::rule {
@@ -39,6 +42,7 @@ define site_shorewall::dnat_rule {
             destination     => "\$FW:${site_openvpn::limited_gateway_address}:1194",
             proto           => 'udp',
             destinationport => $port,
+            originaldest    => $site_openvpn::unlimited_gateway_address,
             order           => 100;
       }
     }
-- 
cgit v1.2.3


From 896dd69710fa24a0235fc70081a71f35adbf9af1 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 20 Nov 2014 15:22:09 -0500
Subject: Make sure that stunnel restarts when cert/key change (#6181)

Change-Id: I5085247a87018e18e73833119ac73225afbfea1e
---
 puppet/modules/site_stunnel/manifests/client.pp           |  6 +-----
 puppet/modules/site_stunnel/manifests/init.pp             |  2 ++
 puppet/modules/site_stunnel/manifests/override_service.pp | 13 +++++++++++++
 puppet/modules/site_stunnel/manifests/servers.pp          |  6 +-----
 4 files changed, 17 insertions(+), 10 deletions(-)
 create mode 100644 puppet/modules/site_stunnel/manifests/override_service.pp

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_stunnel/manifests/client.pp b/puppet/modules/site_stunnel/manifests/client.pp
index 76815174..3b10ecb8 100644
--- a/puppet/modules/site_stunnel/manifests/client.pp
+++ b/puppet/modules/site_stunnel/manifests/client.pp
@@ -35,11 +35,7 @@ define site_stunnel::client (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => $rndfile,
     debuglevel => $debuglevel,
-    sslversion => 'TLSv1',
-    subscribe  => [
-      Class['Site_config::X509::Key'],
-      Class['Site_config::X509::Cert'],
-      Class['Site_config::X509::Ca'] ];
+    sslversion => 'TLSv1';
   }
 
   site_shorewall::stunnel::client { $name:
diff --git a/puppet/modules/site_stunnel/manifests/init.pp b/puppet/modules/site_stunnel/manifests/init.pp
index b292f1cd..2e0cf5b8 100644
--- a/puppet/modules/site_stunnel/manifests/init.pp
+++ b/puppet/modules/site_stunnel/manifests/init.pp
@@ -28,5 +28,7 @@ class site_stunnel {
   $clients = $stunnel['clients']
   $client_sections = keys($clients)
   site_stunnel::clients { $client_sections: }
+
+  include site_stunnel::override_service
 }
 
diff --git a/puppet/modules/site_stunnel/manifests/override_service.pp b/puppet/modules/site_stunnel/manifests/override_service.pp
new file mode 100644
index 00000000..96187048
--- /dev/null
+++ b/puppet/modules/site_stunnel/manifests/override_service.pp
@@ -0,0 +1,13 @@
+class site_stunnel::override_service inherits stunnel::debian {
+
+  include site_config::x509::cert
+  include site_config::x509::key
+  include site_config::x509::ca
+
+  Service[stunnel] {
+    subscribe => [
+                  Class['Site_config::X509::Key'],
+                  Class['Site_config::X509::Cert'],
+                  Class['Site_config::X509::Ca'] ]
+  }
+}
diff --git a/puppet/modules/site_stunnel/manifests/servers.pp b/puppet/modules/site_stunnel/manifests/servers.pp
index 8d537644..b6fac319 100644
--- a/puppet/modules/site_stunnel/manifests/servers.pp
+++ b/puppet/modules/site_stunnel/manifests/servers.pp
@@ -35,11 +35,7 @@ define site_stunnel::servers (
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => '/var/lib/stunnel4/.rnd',
     debuglevel => $debuglevel,
-    sslversion => 'TLSv1',
-    require    => [
-      Class['Site_config::X509::Key'],
-      Class['Site_config::X509::Cert'],
-      Class['Site_config::X509::Ca'] ];
+    sslversion => 'TLSv1';
   }
 
   # allow incoming connections on $accept_port
-- 
cgit v1.2.3


From dff949811324215278ab7e4c2db5de63d8a6218b Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 20 Nov 2014 15:31:27 -0500
Subject: Make sure openvpn is restarted when cert/key change (#6405)

I reformatted the section below for consistency.

Change-Id: I18f5e23850e0c1ab4b1f2ee467d5af54ae9ff303
---
 puppet/modules/site_openvpn/manifests/init.pp | 16 ++++++++++------
 1 file changed, 10 insertions(+), 6 deletions(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index b6331f12..a8d2044d 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -148,13 +148,17 @@ class site_openvpn {
   exec { 'restart_openvpn':
     command     => '/etc/init.d/openvpn restart',
     refreshonly => true,
-    subscribe   => File['/etc/openvpn'],
+    subscribe   => [
+                    File['/etc/openvpn'],
+                    Class['Site_config::X509::Key'],
+                    Class['Site_config::X509::Cert'],
+                    Class['Site_config::X509::Ca'] ],
     require     => [
-      Package['openvpn'],
-      File['/etc/openvpn'],
-      Class['Site_config::X509::Key'],
-      Class['Site_config::X509::Cert'],
-      Class['Site_config::X509::Ca_bundle'] ];
+                    Package['openvpn'],
+                    File['/etc/openvpn'],
+                    Class['Site_config::X509::Key'],
+                    Class['Site_config::X509::Cert'],
+                    Class['Site_config::X509::Ca_bundle'] ];
   }
 
   cron { 'add_gateway_ips.sh':
-- 
cgit v1.2.3


From 503a316e67da2b4e0dbae7db28bbd0574fa3739f Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Thu, 20 Nov 2014 16:27:35 -0500
Subject: ship a modified runit config for bigcouch that raises the open file
 descriptor limits to account for bigcouch sync spikes (#4935)

Change-Id: I242fba31f961b6139ec641e1708b170f5c0d009b
---
 puppet/modules/site_couchdb/files/runit_config    |  6 ++++++
 puppet/modules/site_couchdb/manifests/bigcouch.pp | 10 ++++++++++
 2 files changed, 16 insertions(+)
 create mode 100644 puppet/modules/site_couchdb/files/runit_config

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_couchdb/files/runit_config b/puppet/modules/site_couchdb/files/runit_config
new file mode 100644
index 00000000..169b4832
--- /dev/null
+++ b/puppet/modules/site_couchdb/files/runit_config
@@ -0,0 +1,6 @@
+#!/bin/bash
+exec 2>&1
+export HOME=/home/bigcouch
+ulimit -H -n 32768
+ulimit -S -n 32768
+exec chpst -u bigcouch /opt/bigcouch/bin/bigcouch
diff --git a/puppet/modules/site_couchdb/manifests/bigcouch.pp b/puppet/modules/site_couchdb/manifests/bigcouch.pp
index d71c00c5..16593ec7 100644
--- a/puppet/modules/site_couchdb/manifests/bigcouch.pp
+++ b/puppet/modules/site_couchdb/manifests/bigcouch.pp
@@ -31,4 +31,14 @@ class site_couchdb::bigcouch {
   file { '/var/log/bigcouch':
     ensure => directory
   }
+
+  file { '/etc/sv/bigcouch/run':
+    ensure  => present,
+    source  => 'puppet:///modules/site_couchdb/runit_config',
+    owner   => root,
+    group   => root,
+    mode    => '0755',
+    require => Package['couchdb'],
+    notify  => Service['couchdb']
+  }
 }
-- 
cgit v1.2.3


From 6ebd8cee202c81260c151e7903ff2f16518ffa41 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 20 Nov 2014 23:00:50 +0100
Subject: Fix Check_mk notifications (Bug #6403)

Let check_mk put all hosts into the same "admin" contactgroup,
which is defined as default contactgroup by nagios.

Change-Id: I13b434925711ef2037de0cf6e919ce39a8255a94
---
 puppet/modules/site_check_mk/files/host_contactgroups.mk | 3 +++
 puppet/modules/site_check_mk/manifests/server.pp         | 5 ++++-
 2 files changed, 7 insertions(+), 1 deletion(-)
 create mode 100644 puppet/modules/site_check_mk/files/host_contactgroups.mk

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_check_mk/files/host_contactgroups.mk b/puppet/modules/site_check_mk/files/host_contactgroups.mk
new file mode 100644
index 00000000..e89323fb
--- /dev/null
+++ b/puppet/modules/site_check_mk/files/host_contactgroups.mk
@@ -0,0 +1,3 @@
+host_contactgroups = [
+  ( "admins", ALL_HOSTS ),
+]
diff --git a/puppet/modules/site_check_mk/manifests/server.pp b/puppet/modules/site_check_mk/manifests/server.pp
index aa24d96c..388ae94b 100644
--- a/puppet/modules/site_check_mk/manifests/server.pp
+++ b/puppet/modules/site_check_mk/manifests/server.pp
@@ -40,6 +40,10 @@ class site_check_mk::server {
       content => template('site_check_mk/hostgroups.mk'),
       notify  => Exec['check_mk-refresh'],
       require => Package['check-mk-server'];
+    '/etc/check_mk/conf.d/host_contactgroups.mk':
+      source => 'puppet:///modules/site_check_mk/host_contactgroups.mk',
+      notify  => Exec['check_mk-refresh'],
+      require => Package['check-mk-server'];
     '/etc/check_mk/all_hosts_static':
       content => $all_hosts,
       notify  => Exec['check_mk-refresh'],
@@ -64,6 +68,5 @@ class site_check_mk::server {
       require => Package['nagios-plugins-basic'];
   }
 
-
   include check_mk::agent::local_checks
 }
-- 
cgit v1.2.3


From fbfc88d8e4ff032fd8155e264ba75668b426fdb2 Mon Sep 17 00:00:00 2001
From: Micah Anderson <micah@leap.se>
Date: Sun, 23 Nov 2014 10:30:10 -0500
Subject: fix dependency on x509 ca_bundle class (#6410)

Change-Id: Ia1e7009240d61464d7ba45ad07291664f6a3b768
---
 puppet/modules/site_openvpn/manifests/init.pp | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

(limited to 'puppet/modules')

diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index a8d2044d..d6f9150b 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -152,7 +152,7 @@ class site_openvpn {
                     File['/etc/openvpn'],
                     Class['Site_config::X509::Key'],
                     Class['Site_config::X509::Cert'],
-                    Class['Site_config::X509::Ca'] ],
+                    Class['Site_config::X509::Ca_bundle'] ],
     require     => [
                     Package['openvpn'],
                     File['/etc/openvpn'],
-- 
cgit v1.2.3