summaryrefslogtreecommitdiff
path: root/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'manifests')
-rw-r--r--manifests/base.pp71
-rw-r--r--manifests/centos.pp17
-rw-r--r--manifests/init.pp82
-rw-r--r--manifests/rtrules.pp2
-rw-r--r--manifests/tunnel.pp2
5 files changed, 94 insertions, 80 deletions
diff --git a/manifests/base.pp b/manifests/base.pp
index 4324553..4ee8747 100644
--- a/manifests/base.pp
+++ b/manifests/base.pp
@@ -1,39 +1,48 @@
+# base things for shorewall
class shorewall::base {
- package { 'shorewall':
- ensure => $shorewall::ensure_version,
- }
+ package { 'shorewall':
+ ensure => $shorewall::ensure_version,
+ }
- # This file has to be managed in place, so shorewall can find it
- file {
- '/etc/shorewall/shorewall.conf':
- require => Package[shorewall],
- notify => Service[shorewall],
- owner => root, group => 0, mode => 0644;
- '/etc/shorewall/puppet':
- ensure => directory,
- require => Package[shorewall],
- owner => root, group => 0, mode => 0644;
- }
+ # This file has to be managed in place, so shorewall can find it
+ file {
+ '/etc/shorewall/shorewall.conf':
+ require => Package[shorewall],
+ notify => Service[shorewall],
+ owner => root,
+ group => 0,
+ mode => '0644';
+ '/etc/shorewall/puppet':
+ ensure => directory,
+ require => Package[shorewall],
+ owner => root,
+ group => 0,
+ mode => '0644';
+ }
- if $shorewall::conf_source {
- File['/etc/shorewall/shorewall.conf']{
- source => $shorewall::conf_source,
- }
+ if $shorewall::conf_source {
+ File['/etc/shorewall/shorewall.conf']{
+ source => $shorewall::conf_source,
}
+ } else {
- augeas { 'shorewall_module_config_path':
- changes => 'set /files/etc/shorewall/shorewall.conf/CONFIG_PATH \'"/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"\'',
- lens => 'Shellvars.lns',
- incl => '/etc/shorewall/shorewall.conf',
- notify => Service[shorewall];
- }
+ require augeas
- service{shorewall:
- ensure => running,
- enable => true,
- hasstatus => true,
- hasrestart => true,
- require => Package[shorewall],
- }
+ augeas { 'shorewall_module_config_path':
+ changes => 'set /files/etc/shorewall/shorewall.conf/CONFIG_PATH \'"/etc/shorewall/puppet:/etc/shorewall:/usr/share/shorewall"\'',
+ lens => 'Shellvars.lns',
+ incl => '/etc/shorewall/shorewall.conf',
+ notify => Service['shorewall'],
+ require => Package['shorewall'];
+ }
+ }
+
+ service{'shorewall':
+ ensure => running,
+ enable => true,
+ hasstatus => true,
+ hasrestart => true,
+ require => Package['shorewall'],
+ }
}
diff --git a/manifests/centos.pp b/manifests/centos.pp
index 7968b69..f671bc9 100644
--- a/manifests/centos.pp
+++ b/manifests/centos.pp
@@ -1,12 +1,13 @@
+# things needed on centos
class shorewall::centos inherits shorewall::base {
- if $::lsbmajdistrelease == '6' {
- # workaround for
- # http://comments.gmane.org/gmane.comp.security.shorewall/26991
- file{'/etc/shorewall/params':
- ensure => link,
- target => '/etc/shorewall/puppet/params',
- before => Service['shorewall'],
- require => File['/etc/shorewall/puppet']
+ if $::lsbmajdistrelease > 5 {
+ augeas{'enable_shorewall':
+ context => '/files/etc/sysconfig/shorewall',
+ changes => 'set startup 1',
+ lens => 'Shellvars.lns',
+ incl => '/etc/sysconfig/shorewall',
+ require => Package['shorewall'],
+ notify => Service['shorewall'],
}
}
}
diff --git a/manifests/init.pp b/manifests/init.pp
index 5a7f740..cd6488b 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,3 +1,4 @@
+# Manage shorewall on your system
class shorewall(
$startup = '1',
$conf_source = false,
@@ -16,7 +17,7 @@ class shorewall(
include shorewall::debian
$dist_tor_user = 'debian-tor'
}
- centos: { include shorewall::base }
+ centos: { include shorewall::centos }
ubuntu: {
case $::lsbdistcodename {
karmic: { include shorewall::ubuntu::karmic }
@@ -24,46 +25,49 @@ class shorewall(
}
}
default: {
- notice "unknown operatingsystem: ${::operatingsystem}"
+ notice "unknown operatingsystem: ${::operatingsystem}"
include shorewall::base
}
}
- # See http://www.shorewall.net/3.0/Documentation.htm#Zones
- shorewall::managed_file{ zones: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Interfaces
- shorewall::managed_file{ interfaces: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Hosts
- shorewall::managed_file { hosts: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Policy
- shorewall::managed_file { policy: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Rules
- shorewall::managed_file { rules: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Masq
- shorewall::managed_file{ masq: }
- # See http://www.shorewall.net/3.0/Documentation.htm#ProxyArp
- shorewall::managed_file { proxyarp: }
- # See http://www.shorewall.net/3.0/Documentation.htm#NAT
- shorewall::managed_file { nat: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Blacklist
- shorewall::managed_file { blacklist: }
- # See http://www.shorewall.net/3.0/Documentation.htm#rfc1918
- shorewall::managed_file { rfc1918: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Routestopped
- shorewall::managed_file { routestopped: }
- # See http://www.shorewall.net/3.0/Documentation.htm#Variables
- shorewall::managed_file { params: }
- # See http://www.shorewall.net/3.0/traffic_shaping.htm
- shorewall::managed_file { tcdevices: }
- # See http://www.shorewall.net/3.0/traffic_shaping.htm
- shorewall::managed_file { tcrules: }
- # See http://www.shorewall.net/3.0/traffic_shaping.htm
- shorewall::managed_file { tcclasses: }
- # http://www.shorewall.net/manpages/shorewall-providers.html
- shorewall::managed_file { providers: }
- # See http://www.shorewall.net/manpages/shorewall-tunnels.html
- shorewall::managed_file { tunnel: }
- # See http://www.shorewall.net/MultiISP.html
- shorewall::managed_file { rtrules: }
-
+ shorewall::managed_file{
+ [
+ # See http://www.shorewall.net/3.0/Documentation.htm#Zones
+ 'zones',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Interfaces
+ 'interfaces',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Hosts
+ 'hosts',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Policy
+ 'policy',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Rules
+ 'rules',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Masq
+ 'masq',
+ # See http://www.shorewall.net/3.0/Documentation.htm#ProxyArp
+ 'proxyarp',
+ # See http://www.shorewall.net/3.0/Documentation.htm#NAT
+ 'nat',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Blacklist
+ 'blacklist',
+ # See http://www.shorewall.net/3.0/Documentation.htm#rfc1918
+ 'rfc1918',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Routestopped
+ 'routestopped',
+ # See http://www.shorewall.net/3.0/Documentation.htm#Variables
+ 'params',
+ # See http://www.shorewall.net/3.0/traffic_shaping.htm
+ 'tcdevices',
+ # See http://www.shorewall.net/3.0/traffic_shaping.htm
+ 'tcrules',
+ # See http://www.shorewall.net/3.0/traffic_shaping.htm
+ 'tcclasses',
+ # http://www.shorewall.net/manpages/shorewall-providers.html
+ 'providers',
+ # See http://www.shorewall.net/manpages/shorewall-tunnels.html
+ 'tunnel',
+ # See http://www.shorewall.net/MultiISP.html
+ 'rtrules',
+ ]:;
+ }
}
diff --git a/manifests/rtrules.pp b/manifests/rtrules.pp
index 34e12b4..3810f26 100644
--- a/manifests/rtrules.pp
+++ b/manifests/rtrules.pp
@@ -5,7 +5,7 @@ define shorewall::rtrules(
$priority = '10000',
$mark,
){
- shorewall::entry { "rtrules.d/${mark}-${title}":
+ shorewall::entry { "rtrules-${mark}-${name}":
line => "# ${name}\n${source} ${destination} ${provider} ${priority} ${mark}",
}
}
diff --git a/manifests/tunnel.pp b/manifests/tunnel.pp
index e0c71e7..2cac922 100644
--- a/manifests/tunnel.pp
+++ b/manifests/tunnel.pp
@@ -5,7 +5,7 @@ define shorewall::tunnel(
$gateway_zones = '',
$order = '1'
) {
- shorewall::entry { "tunnel.d/${order}-${title}":
+ shorewall::entry { "tunnel-${order}-${name}":
line => "# ${name}\n${tunnel_type} ${zone} ${gateway} ${gateway_zones}",
}
}
generated by cgit v1.2.3 (git 2.25.1) at 2024-12-28 04:42:33 +0000