diff options
30 files changed, 657 insertions, 281 deletions
@@ -0,0 +1,207 @@ +puppet module for managing tor +============================== + +This module tries to manage tor, making sure it is installed, running, has munin +graphs if desired and allows for configuration of relays, hidden services, exit +policies, etc. + +! Upgrade Notice ! + + the tor::relay{} variables $bandwidth_rate and $bandwidth_burst were previously + used for the tor configuration variables RelayBandwidthRate and + RelayBandwidthBurst, these have been renamed to $relay_bandwidth_rate and + $relay_bandwidth_burst. If you were using these, please rename your variables in + your configuration. + + The variables $bandwidth_rate and $bandwidth_burst are now used for the tor + configuration variables BandwidthRate and BandwidthBurst. If you used + $bandwidth_rate or $bandwidth_burst please be aware that these values have + changed and adjust your configuration as necessary. + + The $tor_ensure_version was converted to a parameter for the tor and + tor::daemon classes. + + The $torsocks_ensure_version was converted to a parameter for the + tor::torsocks class. + + The options that used to be settable with the + tor::daemon::global_opts define now are parameters for the + tor::daemon class, and tor::daemon::global_opts was + removed accordingly. + + +Dependencies +============ + +This module needs: + +- the concat module: git://labs.riseup.net/shared-concat + +Usage +===== + +Installing tor +-------------- + +To install tor, simply include the 'tor' class in your manifests: + + class { 'tor': } + +You can specify the $ensure_version class parameter to get a specific +version installed. + +However, if you want to make configuration changes to your tor daemon, you will +want to instead include the 'tor::daemon' class in your manifests, which will +inherit the 'tor' class from above: + + class { '::tor::daemon': } + +You have the following class parameters that you can specify: + +data_dir (default: '/var/lib/tor') +config_file (default: '/etc/tor/torrc') +use_bridges (default: 0) +automap_hosts_on_resolve (default: 0) +log_rules (default: ['notice file /var/log/tor/notices.log']) + +The data_dir will be used for the tor user's $HOME, and the tor DataDirectory +value. + +The config_file will be managed and the daemon restarted when +it changed. + +use_bridges and automap_hosts_on_resolve are used to set the +UseBridges and AutomapHostsOnResolve torrc settings. + +The log_rules can be an array of different Log lines, each will be added to the +config, for example the following will use syslog: + + class { '::tor::daemon': + log_rules => [ 'notice syslog' ], + } + +If you want to set specific options for the tor class, +you may pass them directly to the tor::daemon in your manifests, +e.g.: + + class { '::tor::daemon': + use_munin => true, + automap_hosts_on_resolve => 1, + } + +Configuring socks +----------------- + +To configure tor socks support, you can do the following: + + tor::daemon::socks { "listen_locally": listen_addresses => [ '127.0.0.1' ]; } + +this will setup the SocksListenAddress to be 127.0.0.1. You also can pass the +following options to tor::daemon::socks: + +$port = 0 - SocksPort +$listen_address - can pass multiple values to configure SocksListenAddress lines +$policies - can pass multiple values to configure SocksPolicy lines + +Installing torsocks +------------------- + +To install torsocks, simply include the 'torsocks' class in your manifests: + + class { 'torsocks': } + +You can specify the $ensure_version class parameter to get a specific +version installed. + +Configuring relays +================== + +An example relay configuration: + + tor::daemon::relay { "foobar": + port => 9001, listen_addresses => '192.168.0.1', address => '192.168.0.1', + bandwidth_rate => '256', bandwidth_burst => '256', contact_info => "Foo <collective at example dot com>", + my_family => '<long family string here>' + } + +You have the following options that can be passed to a relay, with the defaults shown: + +$port = 0, +$listen_addresses = [], +$bandwidth_rate = '', # KB/s, defaulting to using tor's default: 5120KB/s +$bandwidth_burst = '', # KB/s, defaulting to using tor's default: 10240KB/s +$relay_bandwidth_rate = 0, # KB/s, 0 for no limit. +$relay_bandwidth_burst = 0, # KB/s, 0 for no limit. +$accounting_max = 0, # GB, 0 for no limit. +$accounting_start = [], +$contact_info = '', +$my_family = '', # TODO: autofill with other relays +$address = "tor.${domain}", +$bridge_relay = 0, +$ensure = present +$nickname = $name + +Configuring the control +----------------------- + +To pass parameters to configure the ControlPort and the HashedControlPassword, +you would do something like this: + + tor::daemon::control { "foo-control": + port => '80', hashed_control_password => '<somehash>', + ensure => present +} + +Note: you must pass a hashed password to the control port, if you are going to +use it. + + +Configuring hidden services +--------------------------- + +To configure a tor hidden service you can do something like the following: + + tor::daemon::hidden_service { "hidden_ssh": ports => 22 } + +The HiddenServiceDir is set to the ${data_dir}/${name}. + +Configuring directories +----------------------- + +An example directory configuration: + + tor::daemon::directory { 'ssh_directory': + port => 80, listen_address => '192.168.0.1', + port_front_page => '/etc/tor/tor.html' + } + +Configuring exit policies +-------------------------- + +To configure exit policies, you can do the following: + +tor::daemon::exit_policy { "ssh_exit_policy": + accept => "192.168.0.1:22", + reject => "*:*"; + } + } + + +Polipo +====== + +Polipo support can be enabled by doing: + + include tor::polipo + +this will inherit the tor class by default, remove privoxy if its installed, and +install polipo, making sure it is running. + + +Munin +===== + +If you are using munin, and have the puppet munin module installed, you can set +the use_munin parameter to true when defining the tor::daemon class to have +graphs setup for you. + diff --git a/files/polipo.conf b/files/polipo/polipo.conf index 12b10c4..12b10c4 100644 --- a/files/polipo.conf +++ b/files/polipo/polipo.conf diff --git a/files/polipo.cron b/files/polipo/polipo.cron index aba88bc..aba88bc 100755 --- a/files/polipo.cron +++ b/files/polipo/polipo.cron diff --git a/manifests/base.pp b/manifests/base.pp new file mode 100644 index 0000000..b98451b --- /dev/null +++ b/manifests/base.pp @@ -0,0 +1,14 @@ +# basic management of resources for tor +class tor::base { + package { [ 'tor', 'tor-geoipdb' ]: + ensure => $tor::ensure_version, + } + + service { 'tor': + ensure => running, + enable => true, + hasrestart => true, + hasstatus => true, + require => Package['tor'], + } +} diff --git a/manifests/compact.pp b/manifests/compact.pp new file mode 100644 index 0000000..c0f5919 --- /dev/null +++ b/manifests/compact.pp @@ -0,0 +1,7 @@ +# manage a complete tor +# installation with all the basics +class tor::compact { + include ::tor + include tor::polipo + include tor::torsocks +} diff --git a/manifests/daemon.pp b/manifests/daemon.pp index d1d57df..2440180 100644 --- a/manifests/daemon.pp +++ b/manifests/daemon.pp @@ -1,200 +1,21 @@ -# tor::daemon -class tor::daemon inherits tor { +# manage a snippet based tor installation +class tor::daemon ( + $ensure_version = 'installed', + $use_munin = false, + $data_dir = '/var/lib/tor', + $config_file = '/etc/tor/torrc', + $use_bridges = 0, + $automap_hosts_on_resolve = 0, + $log_rules = [ 'notice file /var/log/tor/notices.log' ] +) { - # config variables - $data_dir = '/var/lib/tor' - $config_file = '/etc/tor/torrc' - $spool_dir = '/var/lib/puppet/modules/tor' - $snippet_dir = "${spool_dir}/torrc.d" - - # packages, user, group - Service['tor'] { - subscribe => File[$config_file], - } - - Package[ 'tor', 'torsocks' ] { - require => File[$data_dir], - } - - group { 'debian-tor': - ensure => present, - allowdupe => false, - } - - user { 'debian-tor': - allowdupe => false, - comment => 'tor user,,,', - ensure => present, - home => $data_dir, - shell => '/bin/bash', - gid => 'debian-tor', - require => Group['debian-tor'], - } - - # directories - file { "${data_dir}": - ensure => directory, - mode => 0700, - owner => 'debian-tor', - group => 'debian-tor', - require => User['debian-tor'], - } - - file { '/etc/tor': - ensure => directory, - mode => 0755, - owner => 'debian-tor', - group => 'debian-tor', - require => User['debian-tor'], - } - - file { "${spool_dir}": - ensure => directory, - owner => 'debian-tor', group => 'debian-tor', mode => 0755, - } - - file { "${snippet_dir}": - ensure => directory, - owner => 'debian-tor', group => 'debian-tor', mode => 0755, - require => File[$spool_dir], - } - - # tor configuration file - concatenated_file { "${config_file}": - dir => $snippet_dir, - mode => 0600, - owner => 'debian-tor', group => 'debian-tor', + class{'tor': + ensure_version => $ensure_version, } - # config file headers - concatenated_file_part { '00.header': - dir => $snippet_dir, - content => template('tor/torrc.header.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - ensure => present, - } - - # global configurations - define global_opts( $data_dir = $tor::daemon::data_dir, - $log_rules = [ 'notice file /var/log/tor/notices.log' ] ) { - - concatenated_file_part { '01.global': - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.global.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - } - } - - # socks definition - define socks( $port = 0, - $listen_addresses = [], - $policies = [] ) { + include tor::daemon::base - concatenated_file_part { '02.socks': - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.socks.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - } + if $use_munin { + include tor::munin } - - # relay definition - define relay( $port = 0, - $listen_addresses = [], - $outbound_bindaddresses = $listen_addresses, - $bandwidth_rate = 0, # KB/s, 0 for no limit. - $bandwidth_burst = 0, # KB/s, 0 for no limit. - $accounting_max = 0, # GB, 0 for no limit. - $accounting_start = [], - $contact_info = '', - $my_family = '', # TODO: autofill with other relays - $address = "tor.${domain}", - $bridge_relay = 0, - $ensure = present ) { - $nickname = $name - - concatenated_file_part { '03.relay': - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.relay.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - ensure => $ensure, - } - } - - # control definition - define control( $port = 0, - $hashed_control_password = '', - $ensure = present ) { - - if $hashed_control_password == '' and $ensure != 'absent' { - fail("You need to define the tor control password") - } - - concatenated_file_part { '04.control': - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.control.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0600, - ensure => $ensure, - } - } - - # hidden services definition - define hidden_service( $ports = [], - $data_dir = $tor::daemon::data_dir, - $ensure = present ) { - - concatenated_file_part { "05.hidden_service.${name}": - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.hidden_service.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - ensure => $ensure, - } - } - - # directory advertising - define directory ( $port = 0, - $listen_addresses = [], - $port_front_page = '/etc/tor/tor.html', - $ensure = present ) { - - concatenated_file_part { '06.directory': - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.directory.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - ensure => $ensure, - } - - file { '/etc/tor/tor.html': - source => "puppet:///modules/tor/tor.html", - require => File['/etc/tor'], - ensure => $ensure, - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - } - } - - # exit policies - define exit_policy( $accept = [], - $reject = [], - $reject_private = 1, - $ensure = present ) { - - concatenated_file_part { "07.exit_policy.${name}": - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.exit_policy.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - ensure => $ensure, - } - } - - # map address definition - define map_address( $address = '', - $newaddress = '') { - - concatenated_file_part { "08.map_address.${name}": - dir => $tor::daemon::snippet_dir, - content => template('tor/torrc.map_address.erb'), - owner => 'debian-tor', group => 'debian-tor', mode => 0644, - ensure => $ensure, - } - } } - diff --git a/manifests/daemon/base.pp b/manifests/daemon/base.pp new file mode 100644 index 0000000..63d7bc4 --- /dev/null +++ b/manifests/daemon/base.pp @@ -0,0 +1,77 @@ +# extend basic tor things with a snippet based daemon configuration +class tor::daemon::base inherits tor::base { + # packages, user, group + Service['tor'] { + subscribe => File[$tor::daemon::config_file], + } + + Package[ 'tor' ] { + require => File[$tor::daemon::data_dir], + } + + group { 'debian-tor': + ensure => present, + allowdupe => false, + } + + user { 'debian-tor': + ensure => present, + allowdupe => false, + comment => 'tor user,,,', + home => $tor::daemon::data_dir, + shell => '/bin/false', + gid => 'debian-tor', + require => Group['debian-tor'], + } + + # directories + file { $tor::daemon::data_dir: + ensure => directory, + mode => '0700', + owner => 'debian-tor', + group => 'debian-tor', + require => User['debian-tor'], + } + + file { '/etc/tor': + ensure => directory, + mode => '0755', + owner => 'debian-tor', + group => 'debian-tor', + require => User['debian-tor'], + } + + file { '/var/lib/puppet/modules/tor': + ensure => absent, + recurse => true, + force => true, + } + + # tor configuration file + concat { $tor::daemon::config_file: + mode => '0600', + owner => 'debian-tor', + group => 'debian-tor', + } + + # config file headers + concat::fragment { '00.header': + ensure => present, + content => template('tor/torrc.header.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 00, + target => $tor::daemon::config_file, + } + + # global configurations + concat::fragment { '01.global': + content => template('tor/torrc.global.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 01, + target => $tor::daemon::config_file, + } +} diff --git a/manifests/daemon/bridge.pp b/manifests/daemon/bridge.pp new file mode 100644 index 0000000..063f565 --- /dev/null +++ b/manifests/daemon/bridge.pp @@ -0,0 +1,18 @@ +# Bridge definition +define tor::daemon::bridge( + $ip, + $port, + $fingerprint = false, + $ensure = present ) { + + concat::fragment { "10.bridge.${name}": + ensure => $ensure, + content => template('tor/torrc.bridge.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 10, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/daemon/control.pp b/manifests/daemon/control.pp new file mode 100644 index 0000000..0172656 --- /dev/null +++ b/manifests/daemon/control.pp @@ -0,0 +1,27 @@ +# control definition +define tor::daemon::control( + $port = 0, + $hashed_control_password = '', + $cookie_authentication = 0, + $cookie_auth_file = '', + $cookie_auth_file_group_readable = '', + $ensure = present ) { + + if $cookie_authentication == '0' and $hashed_control_password == '' and $ensure != 'absent' { + fail('You need to define the tor control password') + } + + if $cookie_authentication == 0 and ($cookie_auth_file != '' or $cookie_auth_file_group_readable != '') { + notice('You set a tor cookie authentication option, but do not have cookie_authentication on') + } + + concat::fragment { '04.control': + ensure => $ensure, + content => template('tor/torrc.control.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0600', + order => 04, + target => $tor::daemon::config_file, + } +} diff --git a/manifests/daemon/directory.pp b/manifests/daemon/directory.pp new file mode 100644 index 0000000..b71b6e6 --- /dev/null +++ b/manifests/daemon/directory.pp @@ -0,0 +1,27 @@ +# directory advertising +define tor::daemon::directory ( + $port = 0, + $listen_addresses = [], + $port_front_page = '/etc/tor/tor.html', + $ensure = present ) { + + concat::fragment { '06.directory': + ensure => $ensure, + content => template('tor/torrc.directory.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 06, + target => $tor::daemon::config_file, + } + + file { '/etc/tor/tor.html': + ensure => $ensure, + source => 'puppet:///modules/tor/tor.html', + require => File['/etc/tor'], + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + } +} + diff --git a/manifests/daemon/dns.pp b/manifests/daemon/dns.pp new file mode 100644 index 0000000..f3a7027 --- /dev/null +++ b/manifests/daemon/dns.pp @@ -0,0 +1,17 @@ +# DNS definition +define tor::daemon::dns( + $port = 0, + $listen_addresses = [], + $ensure = present ) { + + concat::fragment { "08.dns.${name}": + ensure => $ensure, + content => template('tor/torrc.dns.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 08, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/daemon/exit_policy.pp b/manifests/daemon/exit_policy.pp new file mode 100644 index 0000000..f459ece --- /dev/null +++ b/manifests/daemon/exit_policy.pp @@ -0,0 +1,18 @@ +# exit policies +define tor::daemon::exit_policy( + $accept = [], + $reject = [], + $reject_private = 1, + $ensure = present ) { + + concat::fragment { "07.exit_policy.${name}": + ensure => $ensure, + content => template('tor/torrc.exit_policy.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 07, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/daemon/hidden_service.pp b/manifests/daemon/hidden_service.pp new file mode 100644 index 0000000..c827211 --- /dev/null +++ b/manifests/daemon/hidden_service.pp @@ -0,0 +1,17 @@ +# hidden services definition +define tor::daemon::hidden_service( + $ports = [], + $data_dir = $tor::daemon::data_dir, + $ensure = present ) { + + concat::fragment { "05.hidden_service.${name}": + ensure => $ensure, + content => template('tor/torrc.hidden_service.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 05, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/daemon/map_address.pp b/manifests/daemon/map_address.pp new file mode 100644 index 0000000..e970fe5 --- /dev/null +++ b/manifests/daemon/map_address.pp @@ -0,0 +1,17 @@ +# map address definition +define tor::daemon::map_address( + $address = '', + $newaddress = '' + $ensure = 'present') { + + concat::fragment { "08.map_address.${name}": + ensure => $ensure, + content => template('tor/torrc.map_address.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 08, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/daemon/relay.pp b/manifests/daemon/relay.pp new file mode 100644 index 0000000..d5296de --- /dev/null +++ b/manifests/daemon/relay.pp @@ -0,0 +1,41 @@ +# relay definition +define tor::daemon::relay( + $port = 0, + $listen_addresses = [], + $outbound_bindaddresses = [], + # KB/s, defaulting to using tor's default: 5120KB/s + $bandwidth_rate = '', + # KB/s, defaulting to using tor's default: 10240KB/s + $bandwidth_burst = '', + # KB/s, 0 for no limit + $relay_bandwidth_rate = 0, + # KB/s, 0 for no limit + $relay_bandwidth_burst = 0, + # GB, 0 for no limit + $accounting_max = 0, + $accounting_start = [], + $contact_info = '', + # TODO: autofill with other relays + $my_family = '', + $address = "tor.${::domain}", + $bridge_relay = 0, + $ensure = present ) { + + $nickname = $name + + if $outbound_bindaddresses == [] { + $real_outbound_bindaddresses = $listen_addresses + } else { + $real_outbound_bindaddresses = $outbound_bindaddresses + } + + concat::fragment { '03.relay': + ensure => $ensure, + content => template('tor/torrc.relay.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 03, + target => $tor::daemon::config_file, + } +} diff --git a/manifests/daemon/snippet.pp b/manifests/daemon/snippet.pp new file mode 100644 index 0000000..b9089b4 --- /dev/null +++ b/manifests/daemon/snippet.pp @@ -0,0 +1,16 @@ +# Arbitrary torrc snippet definition +define tor::daemon::snippet( + $content = '', + $ensure = present ) { + + concat::fragment { "99.snippet.${name}": + ensure => $ensure, + content => $content, + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 99, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/daemon/socks.pp b/manifests/daemon/socks.pp new file mode 100644 index 0000000..910461c --- /dev/null +++ b/manifests/daemon/socks.pp @@ -0,0 +1,15 @@ +# socks definition +define tor::daemon::socks( + $port = 0, + $listen_addresses = [], + $policies = [] ) { + + concat::fragment { '02.socks': + content => template('tor/torrc.socks.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 02, + target => $tor::daemon::config_file, + } +} diff --git a/manifests/daemon/transparent.pp b/manifests/daemon/transparent.pp new file mode 100644 index 0000000..74fed4f --- /dev/null +++ b/manifests/daemon/transparent.pp @@ -0,0 +1,17 @@ +# Transparent proxy definition +define tor::daemon::transparent( + $port = 0, + $listen_addresses = [], + $ensure = present ) { + + concat::fragment { "09.transparent.${name}": + ensure => $ensure, + content => template('tor/torrc.transparent.erb'), + owner => 'debian-tor', + group => 'debian-tor', + mode => '0644', + order => 09, + target => $tor::daemon::config_file, + } +} + diff --git a/manifests/init.pp b/manifests/init.pp index 0c38073..9c19c64 100644 --- a/manifests/init.pp +++ b/manifests/init.pp @@ -1,25 +1,6 @@ -class tor { - - if !$tor_ensure_version { $tor_ensure_version = 'installed' } - if !$torsocks_ensure_version { $torsocks_ensure_version = 'installed'} - - package { [ "tor", "tor-geoipdb" ]: - ensure => $tor_ensure_version, - } - - package { "torsocks": - ensure => $torsocks_ensure_version, - } - - service { 'tor': - ensure => running, - enable => true, - hasrestart => true, - hasstatus => true, - require => Package['tor'], - } - - if $use_munin { - include tor::munin - } +# manage a basic tor installation +class tor ( + $ensure_version = 'installed' +){ + include tor::base } diff --git a/manifests/munin.pp b/manifests/munin.pp index ac2630a..4412337 100644 --- a/manifests/munin.pp +++ b/manifests/munin.pp @@ -1,23 +1,21 @@ +# munin plugins for puppet class tor::munin { - - file { - "/usr/local/share/munin-plugins/tor_connections": - source => "puppet:///modules/tor/munin/tor_connections", - mode => 0755, owner => root, group => root; - - "/usr/local/share/munin-plugins/tor_routers": - source => "puppet:///modules/tor/munin/tor_routers", - mode => 0755, owner => root, group => root; - - "/usr/local/share/munin-plugins/tor_traffic": - source => "puppet:///modules/tor/munin/tor_traffic", - mode => 0755, owner => root, group => root; + tor::daemon::control{ + 'control_port_for_munin': + port => 19051, + cookie_authentication => 1, + cookie_auth_file => '/var/run/tor/control.authcookie', } - munin::plugin { - [ "tor_connections", "tor_routers", "tor_traffic" ]: - ensure => present, - config => "user debian-tor\n env.cookiefile /var/lib/tor/control_auth_cookie", - script_path_in => "/usr/local/share/munin-plugins"; + Munin::Plugin::Deploy { + config => "user debian-tor\n env.cookiefile /var/run/tor/control.authcookie\n env.port 19051" + } + munin::plugin::deploy { + 'tor_connections': + source => 'tor/munin/tor_connections'; + 'tor_routers': + source => 'tor/munin/tor_routers'; + 'tor_traffic': + source => 'tor/munin/tor_traffic'; } } diff --git a/manifests/polipo.pp b/manifests/polipo.pp index 73eaea2..73dc226 100644 --- a/manifests/polipo.pp +++ b/manifests/polipo.pp @@ -1,43 +1,9 @@ -class tor::polipo inherits tor { +# manage the polipo proxy service +class tor::polipo { + include ::tor - package { "privoxy": - ensure => absent, + case $::operatingsystem { + 'debian': { include tor::polipo::debian } + default: { include tor::polipo::base } } - - package { "polipo": - ensure => installed, - } - - service { "polipo": - ensure => running, - require => [ Package["polipo"], Service["tor"] ], - } - - file { "/etc/polipo": - ensure => directory, - owner => root, - group => root, - mode => 0755, - } - - file { "/etc/polipo/config": - ensure => present, - owner => root, - group => root, - mode => 0644, - source => "puppet:///modules/tor/polipo.conf", - notify => Service["polipo"], - require => File["/etc/polipo"], - } - - # TODO: restore file to original state after the following bug is solved: - # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=580434 - file { "/etc/cron.daily/polipo": - ensure => present, - owner => root, - group => root, - mode => 0755, - source => "puppet:///modules/tor/polipo.cron", - } - } diff --git a/manifests/polipo/base.pp b/manifests/polipo/base.pp new file mode 100644 index 0000000..df2d6ea --- /dev/null +++ b/manifests/polipo/base.pp @@ -0,0 +1,22 @@ +# manage polipo resources +class tor::polipo::base { + package{'polipo': + ensure => present, + } + + file { '/etc/polipo/config': + ensure => present, + owner => root, + group => root, + mode => '0644', + source => 'puppet:///modules/tor/polipo/polipo.conf', + require => Package['polipo'], + notify => Service['polipo'], + } + + service { 'polipo': + ensure => running, + enable => true, + require => [ Package['polipo'], Service['tor'] ], + } +} diff --git a/manifests/polipo/debian.pp b/manifests/polipo/debian.pp new file mode 100644 index 0000000..e39f603 --- /dev/null +++ b/manifests/polipo/debian.pp @@ -0,0 +1,13 @@ +# manage polipo on debian +class tor::polipo::debian inherits tor::polipo::base { + # TODO: restore file to original state after the following bug is solved: + # http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=580434 + file { '/etc/cron.daily/polipo': + ensure => present, + owner => root, + group => root, + mode => '0755', + require => Package['polipo'], + source => 'puppet:///modules/tor/polipo/polipo.cron', + } +} diff --git a/manifests/torsocks.pp b/manifests/torsocks.pp new file mode 100644 index 0000000..e9fc75b --- /dev/null +++ b/manifests/torsocks.pp @@ -0,0 +1,9 @@ +# manage torsocks +class tor::torsocks ( + $ensure_version = 'installed' +){ + include ::tor + package{'torsocks': + ensure => $ensure_version, + } +} diff --git a/templates/torrc.bridge.erb b/templates/torrc.bridge.erb new file mode 100644 index 0000000..58ef70d --- /dev/null +++ b/templates/torrc.bridge.erb @@ -0,0 +1,3 @@ +# Bridge <%= name%> +Bridge <%= ip%>:<%= port%><%- if fingerprint -%> <%= fingerprint%><%- end -%> + diff --git a/templates/torrc.control.erb b/templates/torrc.control.erb index df9513a..336c72d 100644 --- a/templates/torrc.control.erb +++ b/templates/torrc.control.erb @@ -1,6 +1,16 @@ # tor controller <%- if port != '0' then -%> ControlPort <%= port %> +<%- if cookie_authentication != '0' then -%> +CookieAuthentication 1 +<%- if cookie_auth_file != '' then -%> +CookieAuthFile <%= cookie_auth_file %> +<%- end -%> +<%- if cookie_auth_file_group_readable != '' then -%> +CookieAuthFileGroupReadable <%= cookie_auth_file_group_readable %> +<%- end -%> +<%- else -%> HashedControlPassword <%= hashed_control_password %> <%- end -%> +<%- end -%> diff --git a/templates/torrc.dns.erb b/templates/torrc.dns.erb new file mode 100644 index 0000000..bd1e719 --- /dev/null +++ b/templates/torrc.dns.erb @@ -0,0 +1,5 @@ +# DNS +DNSPort <%= port %> +<%- for listen_address in listen_addresses -%> +DNSListenAddress <%= listen_address %> +<%- end -%> diff --git a/templates/torrc.global.erb b/templates/torrc.global.erb index 6ca49de..3a3b623 100644 --- a/templates/torrc.global.erb +++ b/templates/torrc.global.erb @@ -11,3 +11,5 @@ Log <%= log_rule %> Log notice syslog <%- end -%> +AutomapHostsOnResolve <%= automap_hosts_on_resolve%> +UseBridges <%= use_bridges%> diff --git a/templates/torrc.relay.erb b/templates/torrc.relay.erb index 2ab34bf..85320d3 100644 --- a/templates/torrc.relay.erb +++ b/templates/torrc.relay.erb @@ -4,7 +4,7 @@ ORPort <%= port %> <%- for listen_address in listen_addresses -%> ORListenAddress <%= listen_address %> <%- end -%> -<%- for outbound_bindaddress in outbound_bindaddresses -%> +<%- for outbound_bindaddress in real_outbound_bindaddresses -%> OutboundBindAddress <%= outbound_bindaddress %> <%- end -%> <%- if nickname != '' then -%> @@ -13,11 +13,17 @@ Nickname <%= nickname %> <%- if address != '' then -%> Address <%= address %> <%- end -%> -<%- if bandwidth_rate != '0' then -%> -RelayBandwidthRate <%= bandwidth_rate %> KB +<%- if bandwidth_rate != '' then -%> +BandwidthRate <%= bandwidth_rate %> KB <%- end -%> -<%- if bandwidth_burst != '0' then -%> -RelayBandwidthBurst <%= bandwidth_burst %> KB +<%- if bandwidth_burst != '' then -%> +BandwidthBurst <%= bandwidth_burst %> KB +<%- end -%> +<%- if relay_bandwidth_rate != '0' then -%> +RelayBandwidthRate <%= relay_bandwidth_rate %> KB +<%- end -%> +<%- if relay_bandwidth_burst != '0' then -%> +RelayBandwidthBurst <%= relay_bandwidth_burst %> KB <%- end -%> <%- if accounting_max != '0' then -%> AccountingMax <%= accounting_max %> GB diff --git a/templates/torrc.transparent.erb b/templates/torrc.transparent.erb new file mode 100644 index 0000000..dae97dc --- /dev/null +++ b/templates/torrc.transparent.erb @@ -0,0 +1,5 @@ +# Transparent proxy +TransPort <%= port %> +<%- for listen_address in listen_addresses -%> +TransListenAddress <%= listen_address %> +<%- end -%> |