From f800dcdec71dc594940a94aba45c5dee024ce6e8 Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Thu, 10 Nov 2011 18:03:10 -0200
Subject: SSL computational DoS mitigation (3)

---
 manifests/vserver.pp | 20 ++++++++++----------
 1 file changed, 10 insertions(+), 10 deletions(-)

(limited to 'manifests/vserver.pp')

diff --git a/manifests/vserver.pp b/manifests/vserver.pp
index 67ece43..d59bcd6 100644
--- a/manifests/vserver.pp
+++ b/manifests/vserver.pp
@@ -3,16 +3,6 @@ class nodo::vserver inherits nodo {
   include timezone
   include syslog-ng::vserver
 
-  # SSL computational DoS mitigation
-  # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
-  $firewall_ssl_ratelimit = $firewall_ssl_ratelimit ? {
-    ''      => $firewall_global_ssl_ratelimit ? {
-      ''      => '-',
-      default => $firewall_global_ssl_ratelimit,
-    },
-    default => $firewall_ssl_ratelimit,
-  }
-
   backupninja::sys { "sys":
     ensure     => present,
     partitions => false,
@@ -130,6 +120,16 @@ class nodo::vserver inherits nodo {
       }
     }
 
+    # SSL computational DoS mitigation
+    # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
+    $firewall_ssl_ratelimit = $firewall_ssl_ratelimit ? {
+      ''      => $firewall_global_ssl_ratelimit ? {
+        ''      => '-',
+        default => $firewall_global_ssl_ratelimit,
+      },
+      default => $firewall_ssl_ratelimit,
+    }
+
     # Apply firewall rules just for running vservers
     case $ensure {
       'running': {
-- 
cgit v1.2.3