modules/roles/manifests/sip.pp

   1 class roles::sip {
   2         include concat::setup
   3
   4         ssl::service { 'www.debian.org':
   5         }
   6
   7         ssl::service { 'sip-ws.debian.org':
   8         }
   9
  10         concat { '/etc/repro/www.debian.org-chained.crt':
  11         }
  12         concat::fragment { '/etc/ssl/debian/certs/www.debian.org.crt':
  13                 target      => '/etc/repro/www.debian.org-chained.crt',
  14                 source      => 'file:///etc/ssl/debian/certs/www.debian.org.crt',
  15                 order       => 00,
  16                 require     => File['/etc/ssl/debian/certs/www.debian.org.crt'],
  17         }
  18         concat::fragment { '/etc/ssl/debian/certs/www.debian.org.crt-chain':
  19                 target      => '/etc/repro/www.debian.org-chained.crt',
  20                 source      => 'file:///etc/ssl/debian/certs/www.debian.org.crt-chain',
  21                 order       => 99,
  22                 require     => File['/etc/ssl/debian/certs/www.debian.org.crt-chain'],
  23         }
  24
  25         concat { '/etc/repro/sip-ws.debian.org-chained.crt':
  26         }
  27         concat::fragment { '/etc/ssl/debian/certs/sip-ws.debian.org.crt':
  28                 target      => '/etc/repro/sip-ws.debian.org-chained.crt',
  29                 source      => 'file:///etc/ssl/debian/certs/sip-ws.debian.org.crt',
  30                 order       => 00,
  31                 require     => File['/etc/ssl/debian/certs/sip-ws.debian.org.crt'],
  32         }
  33         concat::fragment { '/etc/ssl/debian/certs/sip-ws.debian.org.crt-chain':
  34                 target      => '/etc/repro/sip-ws.debian.org-chained.crt',
  35                 source      => 'file:///etc/ssl/debian/certs/sip-ws.debian.org.crt-chain',
  36                 order       => 99,
  37                 require     => File['/etc/ssl/debian/certs/sip-ws.debian.org.crt-chain'],
  38         }
  39
  40         @ferm::rule { 'dsa-sip-ws-ip4':
  41                 domain      => 'ip',
  42                 description => 'SIP connections (WebSocket; for WebRTC)',
  43                 rule        => 'proto tcp dport (443) ACCEPT'
  44         }
  45         @ferm::rule { 'dsa-sip-ws-ip6':
  46                 domain      => 'ip6',
  47                 description => 'SIP connections (WebSocket; for WebRTC)',
  48                 rule        => 'proto tcp dport (443) ACCEPT'
  49         }
  50         @ferm::rule { 'dsa-sip-tls-ip4':
  51                 domain      => 'ip',
  52                 description => 'SIP connections (TLS)',
  53                 rule        => 'proto tcp dport (5061) ACCEPT'
  54         }
  55         @ferm::rule { 'dsa-sip-tls-ip6':
  56                 domain      => 'ip6',
  57                 description => 'SIP connections (TLS)',
  58                 rule        => 'proto tcp dport (5061) ACCEPT'
  59         }
  60         @ferm::rule { 'dsa-turn-ip4':
  61                 domain      => 'ip',
  62                 description => 'TURN connections',
  63                 rule        => 'proto udp dport (3478) ACCEPT'
  64         }
  65         @ferm::rule { 'dsa-turn-ip6':
  66                 domain      => 'ip6',
  67                 description => 'TURN connections',
  68                 rule        => 'proto udp dport (3478) ACCEPT'
  69         }
  70         @ferm::rule { 'dsa-turn-tls-ip4':
  71                 domain      => 'ip',
  72                 description => 'TURN connections (TLS)',
  73                 rule        => 'proto tcp dport (5349) ACCEPT'
  74         }
  75         @ferm::rule { 'dsa-turn-tls-ip6':
  76                 domain      => 'ip6',
  77                 description => 'TURN connections (TLS)',
  78                 rule        => 'proto tcp dport (5349) ACCEPT'
  79         }
  80         @ferm::rule { 'dsa-rtp-ip4':
  81                 domain      => 'ip',
  82                 description => 'RTP streams',
  83                 rule        => 'proto udp dport (49152:65535) ACCEPT'
  84         }
  85         @ferm::rule { 'dsa-rtp-ip6':
  86                 domain      => 'ip6',
  87                 description => 'RTP streams',
  88                 rule        => 'proto udp dport (49152:65535) ACCEPT'
  89         }
  90 }