modules/roles/manifests/sip.pp

   1 class roles::sip {
   2         include concat::setup
   3
   4         ssl::service { 'www.debian.org':
   5         }
   6
   7         ssl::service { 'sip-ws.debian.org':
   8         }
   9
  10         concat { '/etc/ssl/debian/certs/www.debian.org-chained.crt':
  11                 notify      => Exec['refresh_debian_hashes'],
  12         }
  13         concat::fragment { '/etc/ssl/debian/certs/www.debian.org.crt':
  14                 target      => '/etc/ssl/debian/certs/www.debian.org-chained.crt',
  15                 source      => 'file:///etc/ssl/debian/certs/www.debian.org.crt',
  16                 order       => 00,
  17                 require     => File['/etc/ssl/debian/certs/www.debian.org.crt'],
  18         }
  19         concat::fragment { '/etc/ssl/debian/certs/www.debian.org.crt-chain':
  20                 target      => '/etc/ssl/debian/certs/www.debian.org-chained.crt',
  21                 source      => 'file:///etc/ssl/debian/certs/www.debian.org.crt-chain',
  22                 order       => 99,
  23                 require     => File['/etc/ssl/debian/certs/www.debian.org.crt-chain'],
  24         }
  25
  26         concat { '/etc/ssl/debian/certs/sip-ws.debian.org-chained.crt':
  27         }
  28         concat::fragment { '/etc/ssl/debian/certs/sip-ws.debian.org.crt':
  29                 target      => '/etc/ssl/debian/certs/sip-ws.debian.org-chained.crt',
  30                 source      => 'file:///etc/ssl/debian/certs/sip-ws.debian.org.crt',
  31                 order       => 00,
  32                 require     => File['/etc/ssl/debian/certs/sip-ws.debian.org.crt'],
  33         }
  34         concat::fragment { '/etc/ssl/debian/certs/sip-ws.debian.org.crt-chain':
  35                 target      => '/etc/ssl/debian/certs/sip-ws.debian.org-chained.crt',
  36                 source      => 'file:///etc/ssl/debian/certs/sip-ws.debian.org.crt-chain',
  37                 order       => 99,
  38                 require     => File['/etc/ssl/debian/certs/sip-ws.debian.org.crt-chain'],
  39         }
  40
  41         @ferm::rule { 'dsa-sip-ws-ip4':
  42                 domain      => 'ip',
  43                 description => 'SIP connections (WebSocket; for WebRTC)',
  44                 rule        => 'proto tcp dport (443) ACCEPT'
  45         }
  46         @ferm::rule { 'dsa-sip-ws-ip6':
  47                 domain      => 'ip6',
  48                 description => 'SIP connections (WebSocket; for WebRTC)',
  49                 rule        => 'proto tcp dport (443) ACCEPT'
  50         }
  51         @ferm::rule { 'dsa-sip-tls-ip4':
  52                 domain      => 'ip',
  53                 description => 'SIP connections (TLS)',
  54                 rule        => 'proto tcp dport (5061) ACCEPT'
  55         }
  56         @ferm::rule { 'dsa-sip-tls-ip6':
  57                 domain      => 'ip6',
  58                 description => 'SIP connections (TLS)',
  59                 rule        => 'proto tcp dport (5061) ACCEPT'
  60         }
  61         @ferm::rule { 'dsa-turn-ip4':
  62                 domain      => 'ip',
  63                 description => 'TURN connections',
  64                 rule        => 'proto udp dport (3478) ACCEPT'
  65         }
  66         @ferm::rule { 'dsa-turn-ip6':
  67                 domain      => 'ip6',
  68                 description => 'TURN connections',
  69                 rule        => 'proto udp dport (3478) ACCEPT'
  70         }
  71         @ferm::rule { 'dsa-turn-tls-ip4':
  72                 domain      => 'ip',
  73                 description => 'TURN connections (TLS)',
  74                 rule        => 'proto tcp dport (5349) ACCEPT'
  75         }
  76         @ferm::rule { 'dsa-turn-tls-ip6':
  77                 domain      => 'ip6',
  78                 description => 'TURN connections (TLS)',
  79                 rule        => 'proto tcp dport (5349) ACCEPT'
  80         }
  81         @ferm::rule { 'dsa-rtp-ip4':
  82                 domain      => 'ip',
  83                 description => 'RTP streams',
  84                 rule        => 'proto udp dport (49152:65535) ACCEPT'
  85         }
  86         @ferm::rule { 'dsa-rtp-ip6':
  87                 domain      => 'ip6',
  88                 description => 'RTP streams',
  89                 rule        => 'proto udp dport (49152:65535) ACCEPT'
  90         }
  91 }