From 859f8ba5cb553d66c9dcdbc232d17a0b641624df Mon Sep 17 00:00:00 2001
From: Thore Bödecker <thore.boedecker@godaddy.com>
Date: Wed, 10 Jul 2019 16:37:50 +0200
Subject: allow preserving of chains in tables

---
 manifests/init.pp | 34 ++++++++++++++++++++++++++++------
 1 file changed, 28 insertions(+), 6 deletions(-)

(limited to 'manifests/init.pp')

diff --git a/manifests/init.pp b/manifests/init.pp
index f1f9aa9..221e148 100644
--- a/manifests/init.pp
+++ b/manifests/init.pp
@@ -1,12 +1,29 @@
 # Class: ferm
 #
-# This class manages ferm installation and rule generation on modern linux systems
+# @summary This class manages ferm installation and rule generation on modern linux systems
 #
-# @example deploy ferm and start it, on node with only ipv6 enabled
-# class{'ferm':
-#   manage_service => true,
-#   ip_versions    =>  ['ip6'],
-# }
+# @example deploy ferm without any configured rules, but also don't start the service or modify existing config files
+#   include ferm
+#
+# @example deploy ferm and start it, on nodes with only ipv6 enabled
+#   class{'ferm':
+#     manage_service  => true,
+#     ip_versions     => ['ip6'],
+#   }
+#
+# @example deploy ferm and don't touch chains from other software, like fail2ban and docker
+#   class{'ferm':
+#     manage_service            => true,
+#     preserve_chains_in_tables => {
+#       'filter' => [
+#         'f2b-sshd',
+#         'DOCKER',
+#         'DOCKER-ISOLATION-STAGE-1',
+#         'DOCKER-ISOLATION-STAGE-2',
+#         'DOCKER-USER',
+#       ]
+#     }
+#   }
 #
 # @param manage_service Disable/Enable the management of the ferm daemon
 #   Default value: false
@@ -49,6 +66,10 @@
 #   Allowed values: (true|false)
 # @param ip_versions Set list of versions of ip we want ot use.
 #   Default value: ['ip', 'ip6']
+# @param preserve_chains_in_tables Hash with table:chains[] to use ferm @preserve for
+#   Default value: Empty Hash
+#   Allowed values: Hash with a list of tables and chains in it to preserve
+#   Example: {'nat' => ['PREROUTING', 'POSTROUTING']}
 class ferm (
   Boolean $manage_service,
   Boolean $manage_configfile,
@@ -64,6 +85,7 @@ class ferm (
   Boolean $input_log_dropped_packets,
   Hash $rules,
   Array[Enum['ip','ip6']] $ip_versions,
+  Hash[String[1],Array[String[1]]] $preserve_chains_in_tables,
 ) {
   contain ferm::install
   contain ferm::config
-- 
cgit v1.2.3