Alexandros Kosiaris has submitted this change and it was merged.
Change subject: Fix ferm rules for install-server, haproxy, backup
......................................................................
Fix ferm rules for install-server, haproxy, backup
All of these are installed on brewster. So punching holes in the role
class to allow for 80, 8080, 8140 TCP ports and 67 UDP port. In the
process also fix backup rules to use the new defs
Change-Id: I41e2550a2094880821ea667cc24427d9b222a795
---
M manifests/backups.pp
M manifests/role/haproxy.pp
M manifests/role/install-server.pp
3 files changed, 27 insertions(+), 10 deletions(-)
Approvals:
Alexandros Kosiaris: Looks good to me, approved
jenkins-bot: Verified
diff --git a/manifests/backups.pp b/manifests/backups.pp
index 04e8977..cc522a4 100644
--- a/manifests/backups.pp
+++ b/manifests/backups.pp
@@ -39,7 +39,7 @@
# TODO: Remove this after #96226 is resolved. It will allow for more
# fine-grained filtering restricting specifically to director
ferm::rule { 'bacula':
- rule => 'proto tcp dport 9102 { saddr $INTERNAL ACCEPT; }'
+ rule => 'proto tcp dport 9102 { saddr $ALL_NETWORKS ACCEPT; }'
}
}
diff --git a/manifests/role/haproxy.pp b/manifests/role/haproxy.pp
index 9e5fb62..f0f5b15 100644
--- a/manifests/role/haproxy.pp
+++ b/manifests/role/haproxy.pp
@@ -1,9 +1,13 @@
class role::puppetproxy {
-
system::role { 'puppetproxy':
description => 'Puppet proxying through haproxy host',
}
+ include base::firewall
+ ferm::rule { 'puppet_haproxy':
+ rule => 'proto tcp dport 8140 { saddr $ALL_NETWORKS ACCEPT; }'
+ }
+
class { 'haproxy':
endpoint_hostname => 'palladium',
endpoint_ip => '10.64.16.160',
diff --git a/manifests/role/install-server.pp b/manifests/role/install-server.pp
index c315a92..091459e 100644
--- a/manifests/role/install-server.pp
+++ b/manifests/role/install-server.pp
@@ -18,7 +18,7 @@
# Class['install-server::web-server']
# Class['install-server::dhcp-server']
# Define['backup::set']
-# Class['ferm']
+# Class['base::firewall']
# Define['ferm::rule']
# Define['apt::pin']
#
@@ -31,15 +31,32 @@
DHCP and Web server',
}
- include ferm
+ include base::firewall
include backup::host
include install-server::ubuntu-mirror
include install-server::apt-repository
include install-server::preseed-server
+
include install-server::tftp-server
+ ferm::rule { 'tftp':
+ rule => 'proto tcp dport tftp { saddr $ALL_NETWORKS ACCEPT; }'
+ }
+
include install-server::caching-proxy
+ ferm::rule { 'proxy':
+ rule => 'proto tcp dport 8080 { saddr $ALL_NETWORKS ACCEPT; }'
+ }
+
include install-server::web-server
+ ferm::service { 'http':
+ proto => 'tcp',
+ port => 'http'
+ }
+
include install-server::dhcp-server
+ ferm::rule { 'dhcp':
+ rule => 'proto udp dport dhcp { saddr $ALL_NETWORKS ACCEPT; }'
+ }
# System user and group for mirroring
generic::systemuser { 'mirror':
@@ -54,10 +71,6 @@
'srv-wikimedia',
]
backup::set { $sets : }
-
- ferm::rule { 'tftp':
- rule => 'proto tcp dport tftp { saddr $ALL_NETWORKS ACCEPT; }'
- }
# pin package to the default, Ubuntu version, instead of our own
apt::pin { [ 'squid', 'squid-common', 'squid-langpack' ]:
@@ -90,7 +103,7 @@
# Requires:
#
# Class['install-server::tftp-server']
-# Class['ferm']
+# Class['base::firewall']
# Define['ferm::rule']
#
# Sample Usage:
@@ -101,7 +114,7 @@
description => 'WMF TFTP server',
}
- include ferm
+ include base::firewall
include install-server::tftp-server
ferm::rule { 'tftp':
--
To view, visit https://gerrit.wikimedia.org/r/101191
To unsubscribe, visit https://gerrit.wikimedia.org/r/settings
Gerrit-MessageType: merged
Gerrit-Change-Id: I41e2550a2094880821ea667cc24427d9b222a795
Gerrit-PatchSet: 1
Gerrit-Project: operations/puppet
Gerrit-Branch: production
Gerrit-Owner: Alexandros Kosiaris <[email protected]>
Gerrit-Reviewer: Alexandros Kosiaris <[email protected]>
Gerrit-Reviewer: jenkins-bot
_______________________________________________
MediaWiki-commits mailing list
[email protected]
https://lists.wikimedia.org/mailman/listinfo/mediawiki-commits
