modules/roles/manifests/pubsub.pp

   1 class roles::pubsub {
   2         include roles::pubsub::params
   3         include roles::pubsub::entities
   4
   5         $cluster_cookie  = $roles::pubsub::params::cluster_cookie
   6
   7         $cc_master       = rainier
   8         $cc_secondary    = rapoport
   9
  10         class { 'rabbitmq':
  11                 config_cluster    => true,
  12                 cluster_nodes     => [
  13                         "rabbit@${cc_master}",
  14                         "rabbit@${cc_secondary}",
  15                 ],
  16                 cluster_node_type => 'disc',
  17                 erlang_cookie     => '8r17so6o1s124ns49sr08n0o24342160',
  18                 delete_guest_user => true,
  19                 tcp_keepalive     => true,
  20                 ssl_only          => true,
  21                 ssl               => true,
  22                 ssl_cacert        => '/etc/ssl/debian/certs/ca.crt',
  23                 ssl_cert          => '/etc/ssl/debian/certs/thishost-server.crt',
  24                 ssl_key           => '/etc/ssl/debian/keys/thishost-server.key',
  25                 ssl_port          => 5671,
  26                 ssl_verify        => 'verify_none',
  27                 manage_repo       => false,
  28         }
  29
  30         user { 'rabbitmq':
  31                 groups => 'ssl-cert'
  32         }
  33
  34         @ferm::rule { 'rabbitmq':
  35                 description => 'rabbitmq connections',
  36                 rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V4)'
  37         }
  38
  39         @ferm::rule { 'rabbitmq-v6':
  40                 domain      => 'ip6',
  41                 description => 'rabbitmq connections',
  42                 rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V6)'
  43         }
  44
  45         @ferm::rule { 'rabbitmq-adm':
  46                 description => 'rabbitmq connections',
  47                 rule        => '&SERVICE_RANGE(tcp, 5671, $DSA_IPS)'
  48         }
  49
  50         @ferm::rule { 'rabbitmq-v6-adm':
  51                 domain      => 'ip6',
  52                 description => 'rabbitmq connections',
  53                 rule        => '&SERVICE_RANGE(tcp, 5671, $DSA_V6_IPS)'
  54         }
  55
  56         if $::hostname == $cc_master {
  57                 $you  = '5.153.231.15'
  58                 $you6 = '2001:41c8:1000:21::21:15'
  59         } else {
  60                 $you  = '5.153.231.16'
  61                 $you6 = '2001:41c8:1000:21::21:16'
  62         }
  63
  64         @ferm::rule { 'rabbitmq_cluster':
  65                 domain      => 'ip',
  66                 description => 'rabbitmq cluster connections',
  67                 rule        => "proto tcp mod state state (NEW) saddr (${you}) ACCEPT"
  68         }
  69         @ferm::rule { 'rabbitmq_cluster_v6':
  70                 domain      => 'ip6',
  71                 description => 'rabbitmq cluster connections',
  72                 rule        => "proto tcp mod state state (NEW) saddr (${you6}) ACCEPT"
  73         }
  74         @ferm::rule { 'rabbitmq_mgmt':
  75                 description => 'rabbitmq cluster connections',
  76                 rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_IPS)'
  77         }
  78         @ferm::rule { 'rabbitmq_mgmt_v6':
  79                 domain      => '(ip6)',
  80                 description => 'rabbitmq cluster connections',
  81                 rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_V6_IPS)'
  82         }
  83 }