X-Git-Url: https://git.donarmstrong.com/?a=blobdiff_plain;f=modules%2Fferm%2Ftemplates%2Fdefs.conf.erb;h=127b30d2d0b026fbe8d41220125bdc082a652afa;hb=ed48fdfd54cf6f6a2b2879209fd915b51c8c602e;hp=33765795dc6c8b39541b55b2c2524a3e89f6cd56;hpb=27dea080add183c9f84d33e3b19d02a54b89a199;p=dsa-puppet.git diff --git a/modules/ferm/templates/defs.conf.erb b/modules/ferm/templates/defs.conf.erb index 33765795..127b30d2 100644 --- a/modules/ferm/templates/defs.conf.erb +++ b/modules/ferm/templates/defs.conf.erb @@ -8,18 +8,52 @@ } @def &SERVICE_RANGE($proto, $port, $srange) = { - proto $proto mod state state (NEW) dport $port saddr ($srange) ACCEPT; + proto $proto mod state state (NEW) dport $port @subchain "$port" { saddr ($srange) ACCEPT; }" } @def &TCP_UDP_SERVICE($port) = { proto (tcp udp) mod state state (NEW) dport $port ACCEPT; } +@def &TCP_UDP_SERVICE_RANGE($port, $srange) = { + proto (tcp udp) mod state state (NEW) dport $port @subchain "$port" { saddr ($srange) ACCEPT; }" +} + +@def $HOST_MAILRELAY_V4 = (<%= + mailrelay = [] + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['mailrelay'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| + next if ip =~ /:/ + mailrelay << ip + end + end + end + + mailrelay.join(' ') +%>); + +@def $HOST_MAILRELAY_V6 = (<%= + mailrelay = [] + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['mailrelay'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| + next if ip =~ /\./ + mailrelay << ip + end + end + end + + mailrelay.join(' ') +%>); + +@def $HOST_MAILRELAY = ( $HOST_MAILRELAY_V4 $HOST_MAILRELAY_V6 ); + @def $HOST_NAGIOS_V4 = (<%= nagii = [] - localinfo.keys.sort.each do |node| - if localinfo[node]['nagiosmaster'] - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['nagiosmaster'] or scope.lookupvar('site::localinfo')[node]['extranrpeclient'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /:/ nagii << ip end @@ -31,9 +65,9 @@ @def $HOST_NAGIOS_V6 = (<%= nagii = [] - localinfo.keys.sort.each do |node| - if localinfo[node]['nagiosmaster'] - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['nagiosmaster'] or scope.lookupvar('site::localinfo')[node]['extranrpeclient'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /\./ nagii << ip end @@ -47,9 +81,9 @@ @def $HOST_MUNIN_V4 = (<%= munins = [] - localinfo.keys.sort.each do |node| - if localinfo[node]['muninmaster'] - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['muninmaster'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /:/ munins << ip end @@ -61,9 +95,9 @@ @def $HOST_MUNIN_V6 = (<%= munins = [] - localinfo.keys.sort.each do |node| - if localinfo[node]['muninmaster'] - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['muninmaster'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /\./ munins << ip end @@ -77,9 +111,9 @@ @def $HOST_DB_V6 = (<%= dbs = [] - localinfo.keys.sort.each do |node| - if localinfo[node]['dbmaster'] - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['dbmaster'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /\./ dbs << ip end @@ -91,9 +125,9 @@ @def $HOST_DB_V4 = (<%= dbs = [] - localinfo.keys.sort.each do |node| - if localinfo[node]['dbmaster'] - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::localinfo').keys.sort.each do |node| + if scope.lookupvar('site::localinfo')[node]['dbmaster'] + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /:/ dbs << ip end @@ -107,9 +141,9 @@ @def $HOST_DEBIAN_V4 = (<%= dbs = [] - localinfo.keys.sort.each do |node| - next unless (keyinfo.has_key?(node) and keyinfo[node].at(0) and keyinfo[node][0].has_key?('ipHostNumber')) - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::allnodeinfo').keys.sort.each do |node| + next unless scope.lookupvar('site::allnodeinfo')[node].has_key?('ipHostNumber') + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /:/ dbs << ip end @@ -120,9 +154,9 @@ @def $HOST_DEBIAN_V6 = (<%= dbs = [] - localinfo.keys.sort.each do |node| - next unless (keyinfo.has_key?(node) and keyinfo[node].at(0) and keyinfo[node][0].has_key?('ipHostNumber')) - keyinfo[node][0]['ipHostNumber'].each do |ip| + scope.lookupvar('site::allnodeinfo').keys.sort.each do |node| + next unless scope.lookupvar('site::allnodeinfo')[node].has_key?('ipHostNumber') + scope.lookupvar('site::allnodeinfo')[node]['ipHostNumber'].each do |ip| next if ip =~ /\./ dbs << ip end @@ -131,29 +165,63 @@ dbs.join(' ') %>); +@def $HOST_GANETI_V4 = (206.12.19.213/32 206.12.19.217/32); + @def $HOST_DEBIAN = ($HOST_DEBIAN_V4 $HOST_DEBIAN_V6); -@def $sgran = (91.103.132.24/29); +@def $sgran = (91.103.132.24/29 85.158.45.51/32); @def $weasel = (); @def $weasel = ($weasel 86.59.118.144/28); # debian@sil @def $weasel = ($weasel 86.59.21.32/29); # anguilla1 @def $weasel = ($weasel 86.59.30.32/28); # anguilla2 @def $weasel = ($weasel 141.201.27.0/24); # came -@def $weasel = ($weasel 62.99.152.178); # argos.campus-sbg +@def $weasel = ($weasel 141.201.123.0/24); # cosy +@def $weasel = ($weasel 62.99.152.176/28); # campus sbg @def $zobel = (); @def $zobel = ($zobel 87.139.82.80/32); # exit.credativ.com @def $zobel = ($zobel 87.193.134.192/27); # credativ qsc @def $zobel = ($zobel 78.47.2.104/29); # baldur, bragi, saga -@def $luca = (); -@def $DSA_IPS = ($sgran $weasel $zobel $luca); +@def $zobel = ($zobel 92.198.42.24/29); # DG-i Office +@def $zobel = ($zobel 93.94.128.0/21); # DG-i AS +@def $zobel = ($zobel 195.49.152.0/22); # DG-i AS +@def $zobel = ($zobel 194.187.64.0/22); # DG-i AS +@def $luca = (64.71.152.109); +@def $paravoid = (83.212.9.72); # faidon.noc.grnet.gr +@def $tfheen = (); +@def $tfheen = ($tfheen 194.31.39.0/26); # office network +@def $tfheen = ($tfheen 195.159.200.122); # home +@def $tfheen = ($tfheen 77.40.254.120/29); # home +@def $DSA_IPS = ($sgran $weasel $zobel $luca $paravoid $tfheen); @def $sgran6 = (2001:4b10:100b::/48); +@def $sgran6 = ($sgran6 2001:4b10:0000:810b::/64); @def $weasel6 = (); -@def $weasel6 = ($weasel6 2001:826:408:200::/56); # came +@def $weasel6 = ($weasel6 2001:826:408::/48); # unisbg @def $weasel6 = ($weasel6 2001:858:10f::/48); # anguilla @def $zobel6 = (); @def $zobel6 = ($zobel6 2001:6f8:1215::/48); # baldur @def $zobel6 = ($zobel6 2001:6f8:928::/48); # WS2 @def $zobel6 = ($zobel6 2a01:198:549::/48); # WGS20 +@def $zobel6 = ($zobel6 2a01:198:6b2::/48); # AdS20 +@def $zobel6 = ($zobel6 2a02:158::/32); # DG-i AS @def $luca6 = (); -@def $DSA_V6_IPS = ($sgran6 $weasel6 $zobel6 $luca6); +@def $paravoid6 = (2001:648:2340:1:225:64ff:fea4:8590); # faidon.noc.grnet.gr +@def $tfheen6 = (); +@def $tfheen6 = ($tfheen6 2a02:c0:1013:1::/64); # Office +@def $tfheen6 = ($tfheen6 2001:840:f000:4007::/64); # Home, link +@def $tfheen6 = ($tfheen6 2001:840:4007::/48); # Home +@def $DSA_V6_IPS = ($sgran6 $weasel6 $zobel6 $luca6 $paravoid6 $tfheen6); + +@def $USER_christoph = (); +@def $USER_christoph = ($USER_christoph 212.114.250.148/31); +@def $USER_aurel32 = (); +@def $USER_aurel32 = ($USER_aurel32 88.191.126.93); # hall.aurel32.net +@def $USER_aurel32 = ($USER_aurel32 82.232.2.251); # farad.aurel32.net + +@def $BUILDD_SSH_ACCESS = (); +@def $BUILDD_SSH_ACCESS = ($BUILDD_SSH_ACCESS 194.177.211.200); # grieg +@def $BUILDD_SSH_ACCESS = ($BUILDD_SSH_ACCESS 70.103.162.29); # master +@def $BUILDD_SSH_ACCESS = ($BUILDD_SSH_ACCESS 206.12.19.5); # ravel +@def $FREEBSD_SSH_ACCESS = (); +@def $FREEBSD_SSH_ACCESS = ($FREEBSD_SSH_ACCESS $DSA_IPS $BUILDD_SSH_ACCESS); +@def $FREEBSD_SSH_ACCESS = ($FREEBSD_SSH_ACCESS $USER_christoph $USER_aurel32); # buildd admins