diff options
author | Micah Anderson <micah@riseup.net> | 2012-12-04 15:20:13 -0500 |
---|---|---|
committer | Micah Anderson <micah@riseup.net> | 2012-12-04 15:20:13 -0500 |
commit | cf0f8bb58178df4b7ce54abab3684a2240c43855 (patch) | |
tree | d21e18f8dfa6d3b1cf7c9c0213b10bc52f31aaee /README | |
parent | 5052233d92e97263eab292408ed2602db0836d98 (diff) |
Stop shipping the default shorewall.conf file, instead we should let the
operatingsystem package install its default config (this lets us stop having to
keep this file updated), and instead tell people to configure their
shorewall.conf file using the augeas method.
It is possible still to distribute a shorewall.conf from a site-shorewall
directory, however if the file is distributed, then it is not possible to use
the augeas method.
https://labs.riseup.net/code/issues/2738
Diffstat (limited to 'README')
-rw-r--r-- | README | 26 |
1 files changed, 26 insertions, 0 deletions
@@ -35,6 +35,32 @@ installed instead: $shorewall_ensure_version = "4.0.15-1" +The main shorewall.conf is not managed by this module, rather the default one +that your operatingsystem provides is used, and any modifications you wish to do +to it should be configured with augeas, for example, to set IP_FORWARDING=Yes in +shorewall.conf, simply do this: + + augeas { 'enable_ip_forwarding': + changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING Yes', + lens => 'Shellvars.lns', + incl => '/etc/shorewall/shorewall.conf', + notify => Service[shorewall]; + } + +NOTE: this requires the augeas ruby bindings newer than 0.7.3. + +If you need to, you can provide an entire shorewall.conf by placing it in one of +the following locations: + + "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf.$operatingsystem", + "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf", + "puppet:///modules/site-shorewall/shorewall.conf.$operatingsystem.$lsbdistcodename", + "puppet:///modules/site-shorewall/shorewall.conf.$operatingsystem", + "puppet:///modules/site-shorewall/shorewall.conf" + +NOTE: if you distribute a file, you cannot also use augeas, puppet and augeas +will fight forever + Documentation ------------- |