From c58b7476b6fd03cf2c1ad1458337b597e2bcc88a Mon Sep 17 00:00:00 2001
From: Silvio Rhatto <rhatto@riseup.net>
Date: Sat, 19 Jan 2013 16:43:40 -0200
Subject: Moving vserver::instance definition to its own file

---
 manifests/vserver/instance.pp | 190 ++++++++++++++++++++++++++++++++++++++++++
 1 file changed, 190 insertions(+)
 create mode 100644 manifests/vserver/instance.pp

(limited to 'manifests/vserver')

diff --git a/manifests/vserver/instance.pp b/manifests/vserver/instance.pp
new file mode 100644
index 0000000..c2ad6e9
--- /dev/null
+++ b/manifests/vserver/instance.pp
@@ -0,0 +1,190 @@
+# Define a vserver instance
+define vserver::instance($context, $ensure = 'running', $proxy = false,
+                $puppetmaster = false, $gitd = false, $mail = false,
+                $icecast = false, $sound = false, $tor = false,
+                $ticket = false, $memory_limit = false, $distro = 'squeeze',
+                $dns = false, $munin_port = false, $monkeysphere_ssh_port = false,
+                $jabber = false, $mumble = false, $gobby = false, $yacy = false, $rsync = false) {
+
+  # set instance id
+  if $context <= 9 {
+    $id = "0$context"
+  } else {
+    $id = $context
+  }
+
+  # set puppetmaster ssl port
+  case $puppetmaster_port {
+    '': { $puppetmaster_port = "8140" }
+  }
+
+  # set puppetmaster non-ssl port
+  case $puppetmaster_nonssl_port {
+    '': { $puppetmaster_nonssl_port = "8141" }
+  }
+
+  # set tor port
+  case $tor_port {
+    '': { $tor_port = "9001" }
+  }
+
+  vserver { $name:
+    ensure       => $ensure,
+    context      => "$context",
+    mark         => 'default',
+    distro       => $distro,
+    interface    => "eth0:192.168.0.$context/24",
+    hostname     => "$name.$domain",
+    memory_limit => $memory_limit,
+  }
+
+  # Some nodes need a lot of space at /tmp otherwise some admin
+  # tasks like backups might not run.
+  file { "/etc/vservers/${name}/fstab":
+    source  => [ "puppet:///modules/site-nodo/etc/fstab/vserver/$name",
+                 "puppet:///modules/nodo/etc/fstab/vserver" ],
+    owner   => "root",
+    group   => "root",
+    mode    => 0644,
+    ensure  => present,
+    notify  => Exec["vs_restart_${name}"],
+    require => Exec["vs_create_${name}"],
+  }
+
+  # Create a munin virtual resource to be realized in the node
+  @@munin_node { "$name":
+    port => $munin_port ? {
+      false   => "49$id",
+      default => $munin_port,
+    }
+  }
+
+  # Create a monkeysphere virtual resource to be realized in the node
+  @@monkeysphere_host { "$name":
+    port => $monkeysphere_ssh_port ? {
+      false   => "22$id",
+      default => $monkeysphere_ssh_port,
+    }
+  }
+
+  # Sound support
+  if $sound {
+    if !defined(File["/usr/local/sbin/create-sound-devices"]) {
+      file { "/usr/local/sbin/create-sound-devices":
+        ensure => present,
+        source => "puppet:///modules/nodo/sound/devices.sh",
+        owner  => root,
+        group  => root,
+        mode   => 755,
+      }
+    }
+    exec { "/usr/local/sbin/create-sound-devices ${name}":
+      unless  => "/usr/local/sbin/create-sound-devices ${name} --check",
+      user    => root,
+      require => [ Exec["vs_create_${name}"], File["/usr/local/sbin/create-sound-devices"] ],
+    }
+  }
+
+  # SSL computational DoS mitigation
+  # See http://vincent.bernat.im/en/blog/2011-ssl-dos-mitigation.html
+  $firewall_ssl_ratelimit = $firewall_ssl_ratelimit ? {
+    ''      => $firewall_global_ssl_ratelimit ? {
+      ''      => '-',
+      default => $firewall_global_ssl_ratelimit,
+    },
+    default => $firewall_ssl_ratelimit,
+  }
+
+  # Apply firewall rules just for running vservers
+  case $ensure {
+    'running': {
+      firewall::vserver::ssh { "$name":
+        destination => "192.168.0.$context",
+        port_orig => "22$id",
+        port_dest => "22",
+      }
+
+      firewall::vserver::munin { "$name":
+        destination => "192.168.0.$context",
+        port_orig   => "49$id",
+        port_dest   => "49$id",
+      }
+
+      if $proxy {
+        class {
+          "firewall::vserver::http":  destination => "192.168.0.$context";
+          "firewall::vserver::https": destination => "192.168.0.$context";
+        }
+      }
+
+      if $puppetmaster {
+        class {
+          "firewall::vserver::puppetmaster":
+            destination              => "192.168.0.$context",
+            puppetmaster_port        => $puppetmaster_port,
+            puppetmaster_nonssl_port => $puppetmaster_nonssl_port,
+        }
+      }
+
+      if $gitd {
+        class {
+          "firewall::vserver::gitd": destination => "192.168.0.$context";
+        }
+      }
+
+      if $icecast {
+        class {
+          "firewall::vserver::icecast": destination => "192.168.0.$context";
+        }
+      }
+
+      if $mail {
+        class {
+          "firewall::vserver::mail": destination => "192.168.0.$context";
+        }
+      }
+
+      if $dns {
+        class {
+          "firewall::vserver::dns": destination => "192.168.0.$context";
+        }
+      }
+
+      if $tor {
+        class {
+          "firewall::vserver::tor": destination => "192.168.0.$context";
+        }
+      }
+
+      if $jabber {
+        class {
+          "firewall::vserver::jabber": destination => "192.168.0.$context";
+        }
+      }
+
+      if $mumble {
+        class {
+          "firewall::vserver::mumble": destination => "192.168.0.$context";
+        }
+      }
+
+      if $gobby {
+        class {
+          "firewall::vserver::gobby": destination => "192.168.0.$context";
+        }
+      }
+
+      if $yacy {
+        class {
+          "firewall::vserver::yacy": destination => "192.168.0.$context";
+        }
+      }
+
+      if $rsync {
+        class {
+          "firewall::vserver::rsync": destination => "192.168.0.$context";
+        }
+      }
+    }
+  }
+}
-- 
cgit v1.2.3