modules/roles/manifests/rtc.pp

   1 class roles::rtc {
   2
   3         ssl::service { 'www.debian.org':
   4         }
   5
   6         ssl::service { 'sip-ws.debian.org':
   7         }
   8
   9         concat { '/etc/repro/www.debian.org-chained.crt':
  10         }
  11         concat::fragment { '/etc/ssl/debian/certs/www.debian.org.crt':
  12                 target      => '/etc/repro/www.debian.org-chained.crt',
  13                 source      => 'file:///etc/ssl/debian/certs/www.debian.org.crt',
  14                 order       => 00,
  15                 require     => File['/etc/ssl/debian/certs/www.debian.org.crt'],
  16         }
  17         concat::fragment { '/etc/ssl/debian/certs/www.debian.org.crt-chain':
  18                 target      => '/etc/repro/www.debian.org-chained.crt',
  19                 source      => 'file:///etc/ssl/debian/certs/www.debian.org.crt-chain',
  20                 order       => 99,
  21                 require     => File['/etc/ssl/debian/certs/www.debian.org.crt-chain'],
  22         }
  23
  24         concat { '/etc/repro/sip-ws.debian.org-chained.crt':
  25         }
  26         concat::fragment { '/etc/ssl/debian/certs/sip-ws.debian.org.crt':
  27                 target      => '/etc/repro/sip-ws.debian.org-chained.crt',
  28                 source      => 'file:///etc/ssl/debian/certs/sip-ws.debian.org.crt',
  29                 order       => 00,
  30                 require     => File['/etc/ssl/debian/certs/sip-ws.debian.org.crt'],
  31         }
  32         concat::fragment { '/etc/ssl/debian/certs/sip-ws.debian.org.crt-chain':
  33                 target      => '/etc/repro/sip-ws.debian.org-chained.crt',
  34                 source      => 'file:///etc/ssl/debian/certs/sip-ws.debian.org.crt-chain',
  35                 order       => 99,
  36                 require     => File['/etc/ssl/debian/certs/sip-ws.debian.org.crt-chain'],
  37         }
  38
  39         @ferm::rule { 'dsa-sip-ws-ip4':
  40                 domain      => 'ip',
  41                 description => 'SIP connections (WebSocket; for WebRTC)',
  42                 rule        => 'proto tcp dport (443) ACCEPT'
  43         }
  44         @ferm::rule { 'dsa-sip-ws-ip6':
  45                 domain      => 'ip6',
  46                 description => 'SIP connections (WebSocket; for WebRTC)',
  47                 rule        => 'proto tcp dport (443) ACCEPT'
  48         }
  49         @ferm::rule { 'dsa-sip-tls-ip4':
  50                 domain      => 'ip',
  51                 description => 'SIP connections (TLS)',
  52                 rule        => 'proto tcp dport (5061) ACCEPT'
  53         }
  54         @ferm::rule { 'dsa-sip-tls-ip6':
  55                 domain      => 'ip6',
  56                 description => 'SIP connections (TLS)',
  57                 rule        => 'proto tcp dport (5061) ACCEPT'
  58         }
  59         @ferm::rule { 'dsa-turn-ip4':
  60                 domain      => 'ip',
  61                 description => 'TURN connections',
  62                 rule        => 'proto udp dport (3478) ACCEPT'
  63         }
  64         @ferm::rule { 'dsa-turn-ip6':
  65                 domain      => 'ip6',
  66                 description => 'TURN connections',
  67                 rule        => 'proto udp dport (3478) ACCEPT'
  68         }
  69         @ferm::rule { 'dsa-turn-tls-ip4':
  70                 domain      => 'ip',
  71                 description => 'TURN connections (TLS)',
  72                 rule        => 'proto tcp dport (5349) ACCEPT'
  73         }
  74         @ferm::rule { 'dsa-turn-tls-ip6':
  75                 domain      => 'ip6',
  76                 description => 'TURN connections (TLS)',
  77                 rule        => 'proto tcp dport (5349) ACCEPT'
  78         }
  79         @ferm::rule { 'dsa-rtp-ip4':
  80                 domain      => 'ip',
  81                 description => 'RTP streams',
  82                 rule        => 'proto udp dport (49152:65535) ACCEPT'
  83         }
  84         @ferm::rule { 'dsa-rtp-ip6':
  85                 domain      => 'ip6',
  86                 description => 'RTP streams',
  87                 rule        => 'proto udp dport (49152:65535) ACCEPT'
  88         }
  89
  90         file { '/etc/monit/monit.d/50rtc':
  91                 source  => 'puppet:///modules/roles/rtc/monit',
  92                 mode    => '0440'
  93         }
  94 }