modules/ferm/manifests/init.pp

   1 class ferm {
   2     define rule($domain="ip", $table="filter", $chain="INPUT", $rule, $description="", $prio="00", $notarule=false) {
   3         file {
   4             "/etc/ferm/dsa.d/${prio}_${name}":
   5                 ensure  => present,
   6                 owner   => root,
   7                 group   => root,
   8                 mode    => 0400,
   9                 content => template("ferm/ferm-rule.erb"),
  10                 notify  => Exec["ferm restart"],
  11         }
  12     }
  13
  14     # realize (i.e. enable) all @ferm::rule virtual resources
  15     Ferm::Rule <| |>
  16
  17     package {
  18             ferm: ensure => installed;
  19             ulogd: ensure => installed;
  20     }
  21
  22     file {
  23         "/etc/ferm/dsa.d":
  24             ensure => directory,
  25             purge   => true,
  26             force   => true,
  27             recurse => true,
  28             source  => "puppet:///files/empty/",
  29             notify  => Exec["ferm restart"],
  30             require => Package["ferm"];
  31         "/etc/ferm":
  32             ensure  => directory,
  33             mode    => 0755;
  34         "/etc/ferm/conf.d":
  35             ensure => directory,
  36             require => Package["ferm"];
  37         "/etc/default/ferm":
  38             source  => "puppet:///modules/ferm/ferm.default",
  39             require => Package["ferm"],
  40             notify  => Exec["ferm restart"];
  41         "/etc/ferm/ferm.conf":
  42             source  => "puppet:///modules/ferm/ferm.conf",
  43             require => Package["ferm"],
  44             mode    => 0400,
  45             notify  => Exec["ferm restart"];
  46         "/etc/ferm/conf.d/me.conf":
  47             content => template("ferm/me.conf.erb"),
  48             require => Package["ferm"],
  49             mode    => 0400,
  50             notify  => Exec["ferm restart"];
  51         "/etc/ferm/conf.d/defs.conf":
  52             content => template("ferm/defs.conf.erb"),
  53             require => Package["ferm"],
  54             mode    => 0400,
  55             notify  => Exec["ferm restart"];
  56         "/etc/ferm/conf.d/interfaces.conf":
  57             content => template("ferm/interfaces.conf.erb"),
  58             require => Package["ferm"],
  59             mode    => 0400,
  60             notify  => Exec["ferm restart"];
  61         "/etc/logrotate.d/ulogd":
  62             source => "puppet:///modules/ferm/logrotate-ulogd",
  63             require => Package["debian.org"],
  64             ;
  65     }
  66
  67     $munin_ips = split(regsubst($v4ips, '([^,]+)', 'ip_\1', 'G'), ',')
  68
  69     activate_munin_check {
  70         $munin_ips: script => "ip_";
  71     }
  72
  73     define munin_ipv6_plugin() {
  74         file {
  75             "/etc/munin/plugins/$name":
  76                 content =>  "#!/bin/bash\n# This file is under puppet control\n. /usr/share/munin/plugins/ip_\n",
  77                 mode => 555,
  78                 notify => Exec["munin-node restart"],
  79                 ;
  80         }
  81     }
  82     case $v6ips {
  83         'no': {}
  84         default: {
  85            $munin6_ips = split(regsubst($v6ips, '([^,]+)', 'ip_\1', 'G'), ',')
  86             munin_ipv6_plugin {
  87                 $munin6_ips: ;
  88             }
  89            # get rid of old stuff
  90            $munin6_ip6s = split(regsubst($v6ips, '([^,]+)', 'ip6_\1', 'G'), ',')
  91            activate_munin_check {
  92                $munin6_ip6s: ensure => absent;
  93            }
  94         }
  95     }
  96
  97
  98     case getfromhash($nodeinfo, 'buildd') {
  99         true: {
 100             file {
 101                 "/etc/ferm/conf.d/load_ftp_conntrack.conf":
 102                     source => "puppet:///modules/ferm/conntrack_ftp.conf",
 103                     require => Package["ferm"],
 104                     notify  => Exec["ferm restart"];
 105             }
 106         }
 107     }
 108
 109     exec {
 110         "ferm restart":
 111             command     => "/etc/init.d/ferm restart",
 112             refreshonly => true,
 113     }
 114 }
 115 # vim:set et:
 116 # vim:set sts=4 ts=4:
 117 # vim:set shiftwidth=4: