From d4a2a66e9b9641f84168f86db7fa10dd33326c12 Mon Sep 17 00:00:00 2001 From: Marcel Haerry Date: Thu, 4 Aug 2011 14:03:16 +0200 Subject: The order of the section needs to ab adjusted, otherwise things will be place at the wrong place --- README | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) (limited to 'README') diff --git a/README b/README index a0e54ec..feac7fc 100644 --- a/README +++ b/README @@ -46,7 +46,7 @@ class config::site-shorewall { } shorewall::rule_section { 'NEW': - order => 10; + order => 100; } case $shorewall_rfc1918_maineth { -- cgit v1.2.3 From 5f5482a2084029382a10058a287ff85c8c16c7ac Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 6 Jun 2012 01:19:34 -0300 Subject: fix for new style for 2.7 --- README | 111 ++++++++++++++++++++--------------------- manifests/base.pp | 16 +++--- manifests/centos.pp | 2 +- manifests/debian.pp | 22 ++++---- manifests/init.pp | 12 +++-- manifests/managed_file.pp | 12 ++--- manifests/routestopped.pp | 10 ++-- manifests/rules/jetty/http.pp | 2 +- manifests/rules/out/ibackup.pp | 9 ++-- manifests/rules/puppet.pp | 21 +++----- templates/debian_default.erb | 6 +-- 11 files changed, 103 insertions(+), 120 deletions(-) (limited to 'README') diff --git a/README b/README index feac7fc..77a845c 100644 --- a/README +++ b/README @@ -21,8 +21,9 @@ Example Example from node.pp: node xy { - $shorewall_startup="0" # create shorewall ruleset but don't startup - include config::site-shorewall + class{'config::site_shorewall': + startup => "0" # create shorewall ruleset but don't startup + } shorewall::rule { 'incoming-ssh': source => 'all', destination => '$FW', action => 'SSH/ACCEPT', order => 200; 'incoming-puppetmaster': source => 'all', destination => '$FW', action => 'Puppetmaster/ACCEPT', order => 300; @@ -32,62 +33,60 @@ node xy { } -class config::site-shorewall { - include shorewall - - # If you want logging: - #shorewall::params { - # 'LOG': value => 'debug'; - # 'MAILSERVER': value => $shorewall_mailserver; - #} - - shorewall::zone {'net': - type => 'ipv4'; - } - - shorewall::rule_section { 'NEW': - order => 100; - } - - case $shorewall_rfc1918_maineth { - '': {$shorewall_rfc1918_maineth = true } - } - - case $shorewall_main_interface { - '': { $shorewall_main_interface = 'eth0' } - } - - shorewall::interface {"$shorewall_main_interface": - zone => 'net', - rfc1918 => $shorewall_rfc1918_maineth, - options => 'tcpflags,blacklist,nosmurfs'; - } - - shorewall::policy { - 'fw-to-fw': - sourcezone => '$FW', - destinationzone => '$FW', - policy => 'ACCEPT', - order => 100; - 'fw-to-net': - sourcezone => '$FW', - destinationzone => 'net', - policy => 'ACCEPT', - shloglevel => '$LOG', - order => 110; - 'net-to-fw': - sourcezone => 'net', - destinationzone => '$FW', - policy => 'DROP', - shloglevel => '$LOG', - order => 120; - } +class config::site_shorewall($startup = '1') { + class{'shorewall': + startup => $startup + } + + # If you want logging: + #shorewall::params { + # 'LOG': value => 'debug'; + #} + + shorewall::zone {'net': + type => 'ipv4'; + } + + shorewall::rule_section { 'NEW': + order => 100; + } + + $shorewall_main_interface hiera('shorewall_main_interface','eth0') + shorewall::interface { $shorewall_main_interface: + zone => 'net', + rfc1918 => hiera('shorewall_rfc1918_maineth',true) + options => 'tcpflags,blacklist,nosmurfs'; + } + + shorewall::policy { + 'fw-to-fw': + sourcezone => '$FW', + destinationzone => '$FW', + policy => 'ACCEPT', + order => 100; + 'fw-to-net': + sourcezone => '$FW', + destinationzone => 'net', + policy => 'ACCEPT', + shloglevel => '$LOG', + order => 110; + 'net-to-fw': + sourcezone => 'net', + destinationzone => '$FW', + policy => 'DROP', + shloglevel => '$LOG', + order => 120; + } - # default Rules : ICMP - shorewall::rule { 'allicmp-to-host': source => 'all', destination => '$FW', order => 200, action => 'AllowICMPs/ACCEPT'; - } - + # default Rules : ICMP + shorewall::rule { + 'allicmp-to-host': + source => 'all', + destination => '$FW', + order => 200, + action => 'AllowICMPs/ACCEPT'; + } } diff --git a/manifests/base.pp b/manifests/base.pp index d3fdec7..709f4b7 100644 --- a/manifests/base.pp +++ b/manifests/base.pp @@ -8,14 +8,14 @@ class shorewall::base { '/etc/shorewall/shorewall.conf': # use OS specific defaults, but use Default if no other is found source => [ - "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf.${operatingsystem}", - "puppet:///modules/site-shorewall/${fqdn}/shorewall.conf", - "puppet:///modules/site-shorewall/shorewall.conf.${operatingsystem}.${lsbdistcodename}", - "puppet:///modules/site-shorewall/shorewall.conf.${operatingsystem}", - "puppet:///modules/site-shorewall/shorewall.conf", - "puppet:///modules/shorewall/shorewall.conf.${operatingsystem}.${lsbdistcodename}", - "puppet:///modules/shorewall/shorewall.conf.${operatingsystem}.${lsbmajdistrelease}", - "puppet:///modules/shorewall/shorewall.conf.${operatingsystem}", + "puppet:///modules/site_shorewall/${::fqdn}/shorewall.conf.${::operatingsystem}", + "puppet:///modules/site_shorewall/${::fqdn}/shorewall.conf", + "puppet:///modules/site_shorewall/shorewall.conf.${::operatingsystem}.${::lsbdistcodename}", + "puppet:///modules/site_shorewall/shorewall.conf.${::operatingsystem}", + "puppet:///modules/site_shorewall/shorewall.conf", + "puppet:///modules/shorewall/shorewall.conf.${::operatingsystem}.${::lsbdistcodename}", + "puppet:///modules/shorewall/shorewall.conf.${::operatingsystem}.${::lsbmajdistrelease}", + "puppet:///modules/shorewall/shorewall.conf.${::operatingsystem}", "puppet:///modules/shorewall/shorewall.conf" ], require => Package[shorewall], diff --git a/manifests/centos.pp b/manifests/centos.pp index c61e03c..7968b69 100644 --- a/manifests/centos.pp +++ b/manifests/centos.pp @@ -1,5 +1,5 @@ class shorewall::centos inherits shorewall::base { - if $lsbmajdistrelease == '6' { + if $::lsbmajdistrelease == '6' { # workaround for # http://comments.gmane.org/gmane.comp.security.shorewall/26991 file{'/etc/shorewall/params': diff --git a/manifests/debian.pp b/manifests/debian.pp index eab54a2..c7ed607 100644 --- a/manifests/debian.pp +++ b/manifests/debian.pp @@ -1,15 +1,11 @@ class shorewall::debian inherits shorewall::base { - case $shorewall_startup { - '': { $shorewall_startup = "1" } - } - file{'/etc/default/shorewall': - #source => "puppet:///modules/shorewall/debian/default", - content => template("shorewall/debian_default.erb"), - require => Package['shorewall'], - notify => Service['shorewall'], - owner => root, group => 0, mode => 0644; - } - Service['shorewall']{ - status => '/sbin/shorewall status' - } + file{'/etc/default/shorewall': + content => template("shorewall/debian_default.erb"), + require => Package['shorewall'], + notify => Service['shorewall'], + owner => root, group => 0, mode => 0644; + } + Service['shorewall']{ + status => '/sbin/shorewall status' + } } diff --git a/manifests/init.pp b/manifests/init.pp index 7c62222..17ff12d 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,17 +1,19 @@ -class shorewall { +class shorewall( + $startup = '1' +) { - case $operatingsystem { + case $::operatingsystem { gentoo: { include shorewall::gentoo } debian: { include shorewall::debian } centos: { include shorewall::centos } ubuntu: { - case $lsbdistcodename { + case $::lsbdistcodename { karmic: { include shorewall::ubuntu::karmic } default: { include shorewall::debian } } } default: { - notice "unknown operatingsystem: $operatingsystem" + notice "unknown operatingsystem: ${::operatingsystem}" include shorewall::base } } @@ -38,7 +40,7 @@ class shorewall { shorewall::managed_file { rfc1918: } # See http://www.shorewall.net/3.0/Documentation.htm#Routestopped shorewall::managed_file { routestopped: } - # See http://www.shorewall.net/3.0/Documentation.htm#Variables + # See http://www.shorewall.net/3.0/Documentation.htm#Variables shorewall::managed_file { params: } # http://www.shorewall.net/manpages/shorewall-providers.html shorewall::managed_file { providers: } diff --git a/manifests/managed_file.pp b/manifests/managed_file.pp index 0beb221..d564daa 100644 --- a/manifests/managed_file.pp +++ b/manifests/managed_file.pp @@ -1,17 +1,17 @@ define shorewall::managed_file () { - concat{ "/etc/shorewall/puppet/$name": + concat{ "/etc/shorewall/puppet/${name}": notify => Service['shorewall'], require => File['/etc/shorewall/puppet'], owner => root, group => 0, mode => 0600; - } + } concat::fragment { "${name}-header": source => "puppet:///modules/shorewall/boilerplate/${name}.header", - target => "/etc/shorewall/puppet/$name", + target => "/etc/shorewall/puppet/${name}", order => '000'; "${name}-footer": source => "puppet:///modules/shorewall/boilerplate/${name}.footer", - target => "/etc/shorewall/puppet/$name", + target => "/etc/shorewall/puppet/${name}", order => '999'; - } -} + } +} diff --git a/manifests/routestopped.pp b/manifests/routestopped.pp index 0b53a1b..cd39762 100644 --- a/manifests/routestopped.pp +++ b/manifests/routestopped.pp @@ -1,14 +1,10 @@ define shorewall::routestopped( - $interface = '', + $interface = $name, $host = '-', $options = '', $order='100' ){ - $real_interface = $interface ? { - '' => $name, - default => $interface, - } shorewall::entry{"routestopped-${order}-${name}": - line => "${real_interface} ${host} ${options}", - } + line => "${interface} ${host} ${options}", + } } diff --git a/manifests/rules/jetty/http.pp b/manifests/rules/jetty/http.pp index be19622..4c0652b 100644 --- a/manifests/rules/jetty/http.pp +++ b/manifests/rules/jetty/http.pp @@ -2,7 +2,7 @@ class shorewall::rules::jetty::http { # dnat shorewall::rule { 'dnat-http-to-jetty': - destination => "net:${ipaddress}:8080", + destination => "net:${::ipaddress}:8080", destinationport => '80', source => 'net', proto => 'tcp', order => 140, action => 'DNAT'; } diff --git a/manifests/rules/out/ibackup.pp b/manifests/rules/out/ibackup.pp index ec12c8b..48714af 100644 --- a/manifests/rules/out/ibackup.pp +++ b/manifests/rules/out/ibackup.pp @@ -1,10 +1,9 @@ -class shorewall::rules::out::ibackup { - case $shorewall_ibackup_host { - '': { fail("You need to define \$shorewall_ibackup_host for ${fqdn}") } - } +class shorewall::rules::out::ibackup( + $backup_host = hiera('shorewall_ibackup_host') +) { shorewall::rule { 'me-net-tcp_backupssh': source => '$FW', - destination => "net:${shorewall_ibackup_host}", + destination => "net:${backup_host}", proto => 'tcp', destinationport => 'ssh', order => 240, diff --git a/manifests/rules/puppet.pp b/manifests/rules/puppet.pp index b53c726..c6fc09b 100644 --- a/manifests/rules/puppet.pp +++ b/manifests/rules/puppet.pp @@ -1,16 +1,11 @@ -class shorewall::rules::puppet { - case $shorewall_puppetserver { - '': { $shorewall_puppetserver = "puppet.${domain}" } - } - case $shorewall_puppetserver_port { - '': { $shorewall_puppetserver_port = '8140' } - } - case $shorewall_puppetserver_signport { - '': { $shorewall_puppetserver_signport = '8141' } - } +class shorewall::rules::puppet( + $puppetserver = hiera('shorewall_puppetserver',"puppet.${domain}"), + $puppetserver_port = hiera('shorewall_puppetserver_port',8140) , + $puppetserver_signport = hiera('shorewall_puppetserver_signport',8141) , +) { shorewall::params{ - 'PUPPETSERVER': value => $shorewall_puppetserver; - 'PUPPETSERVER_PORT': value => $shorewall_puppetserver_port; - 'PUPPETSERVER_SIGN_PORT': value => $shorewall_puppetserver_signport; + 'PUPPETSERVER': value => $puppetserver; + 'PUPPETSERVER_PORT': value => $puppetserver_port; + 'PUPPETSERVER_SIGN_PORT': value => $puppetserver_signport; } } diff --git a/templates/debian_default.erb b/templates/debian_default.erb index 96621f5..ec64cbe 100644 --- a/templates/debian_default.erb +++ b/templates/debian_default.erb @@ -3,11 +3,7 @@ # This file is brought to you by puppet -<% if shorewall_startup == "0" -%> -startup=0 -<% else -%> -startup=1 -<% end -%> +startup=<%= scope.lookupvar('shorewall::startup') == "0" ? '0' : '1' %> # if your Shorewall configuration requires detection of the ip address of a ppp # interface, you must list such interfaces in "wait_interface" to get Shorewall to -- cgit v1.2.3 From 210b66ab54f1c57a10a2e9a342559f77e649658f Mon Sep 17 00:00:00 2001 From: mh Date: Wed, 13 Jun 2012 21:34:55 -0300 Subject: migrate away from hiera stuff --- README | 5 ++--- manifests/rules/munin.pp | 8 ++++---- manifests/rules/out/ibackup.pp | 20 ++++++++++---------- manifests/rules/out/munin.pp | 16 ++++++++-------- manifests/rules/out/puppet.pp | 30 +++++++++++++++++++----------- manifests/rules/puppet.pp | 14 +++++++------- manifests/rules/ssh.pp | 2 +- 7 files changed, 51 insertions(+), 44 deletions(-) (limited to 'README') diff --git a/README b/README index 77a845c..f6d9b99 100644 --- a/README +++ b/README @@ -51,10 +51,9 @@ class config::site_shorewall($startup = '1') { order => 100; } - $shorewall_main_interface hiera('shorewall_main_interface','eth0') - shorewall::interface { $shorewall_main_interface: + shorewall::interface { 'eth0': zone => 'net', - rfc1918 => hiera('shorewall_rfc1918_maineth',true) + rfc1918 => true, options => 'tcpflags,blacklist,nosmurfs'; } diff --git a/manifests/rules/munin.pp b/manifests/rules/munin.pp index 26cebfe..0c86abe 100644 --- a/manifests/rules/munin.pp +++ b/manifests/rules/munin.pp @@ -1,10 +1,10 @@ class shorewall::rules::munin( - $munin_port = hiera('munin_port','4949'), - $munin_collector = hiera('munin_collector','127.0.0.1'), - $collector_source = hiera('shorewall_munin_in_collector_source','net') + $munin_port = '4949', + $munin_collector = '127.0.0.1', + $collector_source = 'net' ){ shorewall::params { 'MUNINPORT': value => $munin_port } - shorewall::params { 'MUNINCOLLECTOR': value => $munin_collector } + shorewall::params { 'MUNINCOLLECTOR': value => join($munin_collector,',') } shorewall::rule{'net-me-munin-tcp': source => "${collector_source}:\$MUNINCOLLECTOR", destination => '$FW', diff --git a/manifests/rules/out/ibackup.pp b/manifests/rules/out/ibackup.pp index 48714af..856bcdb 100644 --- a/manifests/rules/out/ibackup.pp +++ b/manifests/rules/out/ibackup.pp @@ -1,12 +1,12 @@ class shorewall::rules::out::ibackup( - $backup_host = hiera('shorewall_ibackup_host') -) { - shorewall::rule { 'me-net-tcp_backupssh': - source => '$FW', - destination => "net:${backup_host}", - proto => 'tcp', - destinationport => 'ssh', - order => 240, - action => 'ACCEPT'; - } + $backup_host +){ + shorewall::rule { 'me-net-tcp_backupssh': + source => '$FW', + destination => "net:${backup_host}", + proto => 'tcp', + destinationport => 'ssh', + order => 240, + action => 'ACCEPT'; + } } diff --git a/manifests/rules/out/munin.pp b/manifests/rules/out/munin.pp index 7b0a015..004a3d5 100644 --- a/manifests/rules/out/munin.pp +++ b/manifests/rules/out/munin.pp @@ -1,10 +1,10 @@ class shorewall::rules::out::munin { - shorewall::rule { 'me-net-rcp_muninhost': - source => '$FW', - destination => 'net', - proto => 'tcp', - destinationport => '4949', - order => 340, - action => 'ACCEPT'; - } + shorewall::rule { 'me-net-rcp_muninhost': + source => '$FW', + destination => 'net', + proto => 'tcp', + destinationport => '4949', + order => 340, + action => 'ACCEPT'; + } } diff --git a/manifests/rules/out/puppet.pp b/manifests/rules/out/puppet.pp index 5cd4643..cbe8cce 100644 --- a/manifests/rules/out/puppet.pp +++ b/manifests/rules/out/puppet.pp @@ -1,12 +1,20 @@ -class shorewall::rules::out::puppet { - include ::shorewall::rules::puppet - # we want to connect to the puppet server - shorewall::rule { 'me-net-puppet_tcp': - source => '$FW', - destination => 'net:$PUPPETSERVER', - proto => 'tcp', - destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT', - order => 340, - action => 'ACCEPT'; - } +class shorewall::rules::out::puppet( + $puppetserver = "puppet.${::domain}", + $puppetserver_port = 8140, + $puppetserver_signport = 8141 +) { + class{'shorewall::rules::puppet': + puppetserver => $puppetserver, + puppetserver_port => $puppetserver_port, + puppetserver_signport => $puppetserver_signport, + } + # we want to connect to the puppet server + shorewall::rule { 'me-net-puppet_tcp': + source => '$FW', + destination => 'net:$PUPPETSERVER', + proto => 'tcp', + destinationport => '$PUPPETSERVER_PORT,$PUPPETSERVER_SIGN_PORT', + order => 340, + action => 'ACCEPT'; + } } diff --git a/manifests/rules/puppet.pp b/manifests/rules/puppet.pp index c6fc09b..84e7d81 100644 --- a/manifests/rules/puppet.pp +++ b/manifests/rules/puppet.pp @@ -1,11 +1,11 @@ class shorewall::rules::puppet( - $puppetserver = hiera('shorewall_puppetserver',"puppet.${domain}"), - $puppetserver_port = hiera('shorewall_puppetserver_port',8140) , - $puppetserver_signport = hiera('shorewall_puppetserver_signport',8141) , -) { + $puppetserver = "puppet.${::domain}", + $puppetserver_port = 8140, + $puppetserver_signport = 8141 +){ shorewall::params{ - 'PUPPETSERVER': value => $puppetserver; - 'PUPPETSERVER_PORT': value => $puppetserver_port; - 'PUPPETSERVER_SIGN_PORT': value => $puppetserver_signport; + 'PUPPETSERVER': value => $puppetserver; + 'PUPPETSERVER_PORT': value => $puppetserver_port; + 'PUPPETSERVER_SIGN_PORT': value => $puppetserver_signport; } } diff --git a/manifests/rules/ssh.pp b/manifests/rules/ssh.pp index 3b7efa2..3a1b530 100644 --- a/manifests/rules/ssh.pp +++ b/manifests/rules/ssh.pp @@ -1,6 +1,6 @@ class shorewall::rules::ssh( $ports, - $source = hiera('shorewall_ssh_in_source','net') + $source = 'net' ) { shorewall::rule { 'net-me-tcp_ssh': source => $shorewall::rules::ssh::source, -- cgit v1.2.3