class nodo::vserver inherits nodo { include sshd include timezone include syslog-ng::vserver backupninja::sys { "sys": ensure => present, partitions => false, hardware => false, dosfdisk => false, dohwinfo => false, } $hosting_type = $node_hosting_type ? { '' => "direct", default => "$node_hosting_type", } case $hosting_type { "direct": { # Apply munin and monkeysphere configuration for # for directly hosted nodes. Munin_node <<| title == $hostname |>> Monkeysphere_host <<| title == $hostname |>> } "third-party": { # Apply munin configuration for this node for third-party # hosted nodes. munin_node { "$hostname": } monkeysphere_host { "$hostname": port => $node_ssh_port, } } } # Define a vserver instance define instance($context, $ensure = 'running', $proxy = false, $puppetmaster = false, $gitd = false, $mail = false, $icecast = false, $sound = false, $ticket = false, $memory_limit = false, $distro = 'lenny') { # set instance id if $context <= 9 { $id = "0$context" } else { $id = $context } # set puppetmaster ssl port case $puppetmaster_port { '': { $puppetmaster_port = "8140" } } # set puppetmaster non-ssl port case $puppetmaster_nonssl_port { '': { $puppetmaster_nonssl_port = "8141" } } vserver { $name: ensure => $ensure, context => "$context", mark => 'default', distro => $distro, interface => "eth0:192.168.0.$context/24", hostname => "$name.$domain", memory_limit => $memory_limit, } # Some nodes need a lot of space at /tmp otherwise some admin # tasks like backups might not run. file { "/etc/vservers/${name}/fstab": source => [ "puppet://$server/files/etc/fstab/vserver/$name", "puppet://$server/modules/nodo/etc/fstab/vserver" ], owner => "root", group => "root", mode => 0644, ensure => present, notify => Exec["vs_restart_${name}"], require => Exec["vs_create_${name}"], } # Create a munin virtual resource to be realized in the node @@munin_node { "$name": port => "49$id", } # Create a monkeysphere virtual resource to be realized in the node @@monkeysphere_host { "$name": port => "22$id", } # Sound support if $sound { if !defined(File["/usr/local/sbin/create-sound-devices"]) { file { "/usr/local/sbin/create-sound-devices": ensure => present, source => "puppet://$server/modules/nodo/sound/devices.sh", owner => root, group => root, mode => 755, } } exec { "/usr/local/sbin/create-sound-devices ${name}": unless => "/usr/local/sbin/create-sound-devices ${name} --check", user => root, require => [ Exec["vs_create_${name}"], File["/usr/local/sbin/create-sound-devices"] ], } } # Apply firewall rules just for running vservers case $ensure { 'running': { shorewall::rule { "ssh-$context-1": action => 'DNAT', source => 'net', destination => "vm:192.168.0.$context:22", proto => 'tcp', destinationport => "22$id", ratelimit => '-', order => "2$id", } shorewall::rule { "ssh-$context-2": action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:22", proto => 'tcp', destinationport => "22$id", originaldest => "$ipaddress", ratelimit => '-', order => "3$id", } shorewall::rule { "munin-$context-1": action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:49$id", proto => 'tcp', destinationport => "49$id", ratelimit => '-', order => "4$id", } shorewall::rule { "munin-$context-2": action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:49$id", proto => 'tcp', destinationport => "49$id", originaldest => "$ipaddress", ratelimit => '-', order => "5$id", } if $proxy { shorewall::rule { 'http-route-1': action => 'DNAT', source => 'net', destination => "vm:192.168.0.$context:80", proto => 'tcp', destinationport => '80', ratelimit => '-', order => '600', } shorewall::rule { 'http-route-2': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:80", proto => 'tcp', destinationport => '80', originaldest => "$ipaddress", ratelimit => '-', order => '601', } shorewall::rule { 'https-route-1': action => 'DNAT', source => 'net', destination => "vm:192.168.0.$context:443", proto => 'tcp', destinationport => '443', ratelimit => '-', order => '602', } shorewall::rule { 'https-route-2': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:443", proto => 'tcp', destinationport => '443', originaldest => "$ipaddress", ratelimit => '-', order => '602', } } if $puppetmaster { shorewall::rule { 'puppetmaster-1': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:$puppetmaster_port", proto => 'tcp', destinationport => "$puppetmaster_port", ratelimit => '-', order => '700', } shorewall::rule { 'puppetmaster-2': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:$puppetmaster_port", proto => 'udp', destinationport => "$puppetmaster_port", ratelimit => '-', order => '701', } shorewall::rule { 'puppetmaster-3': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:$puppetmaster_port", proto => 'tcp', destinationport => "$puppetmaster_port", originaldest => "$ipaddress", ratelimit => '-', order => '702', } shorewall::rule { 'puppetmaster-4': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:$puppetmaster_port", proto => 'udp', destinationport => "$puppetmaster_port", originaldest => "$ipaddress", ratelimit => '-', order => '703', } shorewall::rule { 'puppetmaster-5': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:$puppetmaster_nonssl_port", proto => 'tcp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => '704', } shorewall::rule { 'puppetmaster-6': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:$puppetmaster_nonssl_port", proto => 'udp', destinationport => "$puppetmaster_nonssl_port", ratelimit => '-', order => '705', } shorewall::rule { 'puppetmaster-7': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:$puppetmaster_nonssl_port", proto => 'tcp', destinationport => "$puppetmaster_nonssl_port", originaldest => "$ipaddress", ratelimit => '-', order => '706', } shorewall::rule { 'puppetmaster-8': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:$puppetmaster_nonssl_port", proto => 'udp', destinationport => "$puppetmaster_nonssl_port", originaldest => "$ipaddress", ratelimit => '-', order => '707', } } if $gitd { shorewall::rule { 'git-daemon-1': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:9418", proto => 'tcp', destinationport => '9418', ratelimit => '-', order => '800', } shorewall::rule { 'git-daemon-2': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:9418", proto => 'tcp', destinationport => '9418', originaldest => "$ipaddress", ratelimit => '-', order => '801', } } if $icecast { shorewall::rule { 'icecast-1': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:8000", proto => 'tcp', destinationport => '8000', ratelimit => '-', order => '900', } shorewall::rule { 'icecast-2': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:8000", proto => 'tcp', destinationport => '8000', originaldest => "$ipaddress", ratelimit => '-', order => '901', } } if $mail { shorewall::rule { 'mail-1': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:25", proto => 'tcp', destinationport => '25', ratelimit => '-', order => '1000', } shorewall::rule { 'mail-2': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:25", proto => 'tcp', destinationport => '25', originaldest => "$ipaddress", ratelimit => '-', order => '1001', } shorewall::rule { 'mail-3': action => 'DNAT', source => 'net', destination => "fw:192.168.0.$context:993", proto => 'tcp', destinationport => '993', ratelimit => '-', order => '1002', } shorewall::rule { 'mail-4': action => 'DNAT', source => '$FW', destination => "fw:192.168.0.$context:993", proto => 'tcp', destinationport => '993', originaldest => "$ipaddress", ratelimit => '-', order => '1003', } } } } } }