modules/roles/manifests/pubsub.pp

   1 class roles::pubsub {
   2         include roles::pubsub::params
   3
   4         $cluster_cookie  = $roles::pubsub::params::cluster_cookie
   5         $admin_password  = $roles::pubsub::params::admin_password
   6         $ftp_password    = $roles::pubsub::params::ftp_password
   7         $buildd_password = $roles::pubsub::params::ftp_password
   8         $cc_master      = rainier
   9         $cc_secondary   = rapoport
  10
  11         class { 'rabbitmq':
  12                 cluster           => true,
  13                 clustermembers    => [
  14                         "rabbit@${cc_master}",
  15                         "rabbit@${cc_secondary}",
  16                 ],
  17                 clustercookie     => '8r17so6o1s124ns49sr08n0o24342160',
  18                 delete_guest_user => true,
  19                 master            => $cc_master,
  20         }
  21
  22         user { 'rabbitmq':
  23                 groups => 'ssl-cert'
  24         }
  25
  26         concat::fragment { 'rabbit_ssl':
  27                 target => '/etc/rabbitmq/rabbitmq.config',
  28                 order  => 35,
  29                 source => 'puppet:///modules/roles/pubsub/rabbitmq.config'
  30         }
  31
  32         rabbitmq_user { 'admin':
  33                 admin    => true,
  34                 password => $admin_password,
  35                 provider => 'rabbitmqctl',
  36         }
  37
  38         rabbitmq_user { 'ftpteam':
  39                 admin    => true,
  40                 password => $ftp_password,
  41                 provider => 'rabbitmqctl',
  42         }
  43
  44         rabbitmq_vhost { 'packages':
  45                 ensure   => present,
  46                 provider => 'rabbitmqctl',
  47         }
  48
  49         rabbitmq_vhost { 'buildd':
  50                 ensure   => present,
  51                 provider => 'rabbitmqctl',
  52         }
  53
  54         rabbitmq_user_permissions { 'admin@buildd':
  55                 configure_permission => '.*',
  56                 read_permission      => '.*',
  57                 write_permission     => '.*',
  58                 provider             => 'rabbitmqctl',
  59                 require              => [
  60                         Rabbitmq_user['admin'],
  61                         Rabbitmq_vhost['buildd']
  62                 ]
  63         }
  64         rabbitmq_user_permissions { 'admin@packages':
  65                 configure_permission => '.*',
  66                 read_permission      => '.*',
  67                 write_permission     => '.*',
  68                 provider             => 'rabbitmqctl',
  69                 require              => [
  70                         Rabbitmq_user['admin'],
  71                         Rabbitmq_vhost['packages']
  72                 ]
  73         }
  74
  75         rabbitmq_user_permissions { 'admin@/':
  76                 configure_permission => '.*',
  77                 read_permission      => '.*',
  78                 write_permission     => '.*',
  79                 provider             => 'rabbitmqctl',
  80                 require              => Rabbitmq_user['admin']
  81         }
  82
  83         rabbitmq_user_permissions { 'ftpteam@packages':
  84                 configure_permission => '.*',
  85                 read_permission      => '.*',
  86                 write_permission     => '.*',
  87                 provider             => 'rabbitmqctl',
  88                 require              => [
  89                         Rabbitmq_user['ftpteam'],
  90                         Rabbitmq_vhost['packages']
  91                 ]
  92         }
  93
  94         rabbitmq_user_permissions { 'buildd@buildd':
  95                 configure_permission => '.*',
  96                 read_permission      => '.*',
  97                 write_permission     => '.*',
  98                 provider             => 'rabbitmqctl',
  99                 require              => [
 100                         Rabbitmq_user['buildd'],
 101                         Rabbitmq_vhost['buildd']
 102                 ]
 103         }
 104
 105         rabbitmq_policy { 'mirror-buildd':
 106                 vhost   => 'buildd',
 107                 match   => '.*',
 108                 policy  => '{"ha-mode":"all"}',
 109                 require => Rabbitmq_vhost['buildd']
 110         }
 111
 112         rabbitmq_policy { 'mirror-packages':
 113                 vhost   => 'packages',
 114                 match   => '.*',
 115                 policy  => '{"ha-mode":"all"}',
 116                 require => Rabbitmq_vhost['packages']
 117         }
 118
 119         rabbitmq_plugin { 'rabbitmq_management':
 120                 ensure   => present,
 121                 provider => 'rabbitmqplugins',
 122                 require  => Package['rabbitmq-server'],
 123                 notify   => Service['rabbitmq-server']
 124         }
 125         rabbitmq_plugin { 'rabbitmq_management_agent':
 126                 ensure   => present,
 127                 provider => 'rabbitmqplugins',
 128                 require  => Package['rabbitmq-server'],
 129                 notify   => Service['rabbitmq-server']
 130         }
 131         rabbitmq_plugin { 'rabbitmq_tracing':
 132                 ensure   => present,
 133                 provider => 'rabbitmqplugins',
 134                 require  => Package['rabbitmq-server'],
 135                 notify   => Service['rabbitmq-server']
 136         }
 137         rabbitmq_plugin { 'rabbitmq_management_visualiser':
 138                 ensure   => present,
 139                 provider => 'rabbitmqplugins',
 140                 require  => Package['rabbitmq-server'],
 141                 notify   => Service['rabbitmq-server']
 142         }
 143
 144         @ferm::rule { 'rabbitmq':
 145                 description => 'rabbitmq connections',
 146                 rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V4)'
 147         }
 148
 149         @ferm::rule { 'rabbitmq-v6':
 150                 domain      => 'ip6',
 151                 description => 'rabbitmq connections',
 152                 rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V6)'
 153         }
 154
 155         if $::hostname == $cc_master {
 156                 $you = $cc_secondary
 157         } else {
 158                 $you = $cc_master
 159         }
 160
 161         @ferm::rule { 'rabbitmq_cluster':
 162                 domain      => '(ip ip6)',
 163                 description => 'rabbitmq cluster connections',
 164                 rule        => "proto tcp mod state state (NEW) saddr (${you}) ACCEPT"
 165         }
 166         @ferm::rule { 'rabbitmq_mgmt':
 167                 description => 'rabbitmq cluster connections',
 168                 rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_IPS)'
 169         }
 170         @ferm::rule { 'rabbitmq_mgmt_v6':
 171                 domain      => '(ip6)',
 172                 description => 'rabbitmq cluster connections',
 173                 rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_V6_IPS)'
 174         }
 175 }