diff options
| -rw-r--r-- | manifests/init.pp | 47 | ||||
| -rw-r--r-- | templates/debian/default (renamed from files/debian/default) | 3 |
2 files changed, 40 insertions, 10 deletions
diff --git a/manifests/init.pp b/manifests/init.pp index 4e44547..444aa94 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,12 +1,37 @@ # # modules/shorewall/manifests/init.pp - manage firewalling with shorewall 3.x # Copyright (C) 2007 David Schmitt <david@schmitt.edv-bus.at> +# adapted by immerda project group - admin+puppet(at)immerda.ch +# adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch +# Copyright (c) 2009 Riseup Networks - micah(shift+2)riseup.net # See LICENSE for the full license granted to you. # # Based on the work of ADNET Ghislain <gadnet@aqueos.com> from AQUEOS # at https://reductivelabs.com/trac/puppet/wiki/AqueosShorewall # +# +# If you need to install a specific version of shorewall other than +# the default one that would be installed by 'ensure => present', then +# you can set the following variable and that specific version will be +# installed instead: +# +# $shorewall_ensure_version = "4.0.15-1" +# +# Debian specific settings: +# +# To set any of the following, simply set them as variables in y our manifests +# before the class is included, for example: +# +# $shorewall_startboot = 1 +# +# shorewall_startboot: specify if shorewall should be enabled at boot +# valid options are: 1 (start at boot), 0 (do not start), +# Default: 1 -> start at boot +# # Changes: +# * added Debian support to specify if shorewall should be enabled on boot or not +# * added support for specifying shorewall package version +# * updated indentation and formatting to standardize on puppet emacs/vim modes # * added support for traffic shapping: http://www.shorewall.net/traffic_shaping.htm # * added extension_script define: http://shorewall.net/shorewall_extension_scripts.htm # * FHS Layout: put configuration in /var/lib/puppet/modules/shorewall and @@ -17,9 +42,6 @@ # * add 000-header and 999-footer files for all managed_files # * added rule_section define and a few more parameters for rules # * add managing for masq, proxyarp, blacklist, nat, rfc1918 -# adapted by immerda project group - admin+puppet(at)immerda.ch -# adapted by Puzzle ITC - haerry+puppet(at)puzzle.ch -# adapted by Riseup Networks - micah(shift+2)riseup.net module_dir { "shorewall": } @@ -244,11 +266,12 @@ class shorewall { } class shorewall::base { - + + if $shorewall_ensure_version == '' { $shorewall_ensure_version = 'present' } package { 'shorewall': - ensure => present, + ensure => $shorewall_ensure_version, } - + # This file has to be managed in place, so shorewall can find it file { "/etc/shorewall/shorewall.conf": # use OS specific defaults, but use Default if no other is found @@ -300,13 +323,19 @@ class shorewall::gentoo inherits shorewall::base { } class shorewall::debian inherits shorewall::base { - file{'/etc/default/shorewall': - source => "puppet://$server/shorewall/debian/default", + + # prepare variables to use in templates + case $shorewall_startboot { + '': { $shorewall_startboot = '1' } + } + + file { '/etc/default/shorewall': + content => template("shorewall/debian/default"), require => Package['shorewall'], notify => Service['shorewall'], owner => root, group => 0, mode => 0644; } - Service['shorewall']{ + Service['shorewall'] { status => '/sbin/shorewall status' } } diff --git a/files/debian/default b/templates/debian/default index ba89cdc..1aaad8c 100644 --- a/files/debian/default +++ b/templates/debian/default @@ -1,7 +1,8 @@ # prevent startup with default configuration # set the following varible to 1 in order to allow Shorewall to start -startup=1 + +startup=<%=shorewall_startboot -%> # if your Shorewall configuration requires detection of the ip address of a ppp # interface, you must list such interfaces in "wait_interface" to get Shorewall to |