Merge branch 'rsync-shuffle'

diff --git a/manifests/site.pp b/manifests/site.pp
index c3a3657c35f92c1a53c9cf77e3135f999a4163e9..cadc12ed4d8d2693733f2ed5aca02f7be8590712 100644 (file)
--- a/manifests/site.pp
+++ b/manifests/site.pp
@@ -65,10 +65,6 @@ node default {
                include apache2
        }
 
-       if $::rsyncd {
-               include rsyncd-log
-       }
-
        if $::hostname in [ravel,senfl,orff,draghi,diamond] {
                include named::authoritative
        } elsif $::hostname in [geo1,geo2,geo3] {

diff --git a/modules/debian-org/lib/facter/software.rb b/modules/debian-org/lib/facter/software.rb
index 2bcc0a63c2e65bdf38899122569eab11c477d0cc..33f1c422b578eb73e8bdec6f24e175660e6367df 100644 (file)
--- a/modules/debian-org/lib/facter/software.rb
+++ b/modules/debian-org/lib/facter/software.rb
@@ -131,15 +131,6 @@ Facter.add("syslogversion") do
                %x{dpkg-query -W -f='${Version}\n' syslog-ng | cut -b1-3}.chomp
        end
 end
-Facter.add("rsyncd") do
-       setcode do
-               if FileTest.exist?("/etc/rsyncd.conf")
-                       true
-               else
-                       ''
-               end
-       end
-end
 Facter.add("unbound") do
        unbound=FileTest.exist?("/usr/sbin/unbound") and
                FileTest.exist?("/var/lib/unbound/root.key")

diff --git a/modules/debian-org/misc/local.yaml b/modules/debian-org/misc/local.yaml
index ee6755ffa0a49818a64d3ef3045ed467675948df..f6df5968b1a570fc62477a48cfd548e3774160e9 100644 (file)
--- a/modules/debian-org/misc/local.yaml
+++ b/modules/debian-org/misc/local.yaml
@@ -149,6 +149,8 @@ services:
   bugsmaster:
   bugsmx:
     - busoni.debian.org
+  bugs_search:
+    - glinka.debian.org
   dbmaster:
     - draghi.debian.org
   ftp_master:
@@ -175,6 +177,10 @@ services:
     - reger.debian.org
   security_master:
     - chopin.debian.org
+  www_master:
+    - wolkenstein.debian.org
+  keyring:
+    - kaufmann.debian.org
 host_settings:
   heavy_exim:
     - bellini.debian.org

diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp
index d6fbb0a1d34b35962c86f10590b8d7962906ea83..2756e59f0b574a16a79a65da28bdfbc5b7dc4a5d 100644 (file)
--- a/modules/ferm/manifests/per-host.pp
+++ b/modules/ferm/manifests/per-host.pp
@@ -3,6 +3,14 @@ class ferm::per-host {
                include ferm::zivit
        }
 
+       if $::hostname in [klecker,merikanto,powell,ravel,rietz,senfl,sibelius,stabile] {
+               ferm::rule { 'dsa-rsync':
+                       domain      => '(ip ip6)',
+                       description => 'Allow rsync access',
+                       rule        => '&SERVICE(tcp, 873)'
+               }
+       }
+
        case $::hostname {
                piatti,samosa: {
                        @ferm::rule { 'dsa-udd-stunnel':
@@ -217,7 +225,4 @@ REJECT reject-with icmp-admin-prohibited
                default: {}
        }
 
-       if $::rsyncd {
-               include ferm::rsync
-       }
 }

diff --git a/modules/ferm/manifests/rsync.pp b/modules/ferm/manifests/rsync.pp
deleted file mode 100644 (file)
index 44feab6..0000000
--- a/modules/ferm/manifests/rsync.pp
+++ /dev/null
@@ -1,8 +0,0 @@
-class ferm::rsync {
-       @ferm::rule { 'dsa-rsync':
-               domain      => '(ip ip6)',
-               description => 'Allow rsync access',
-               rule        => '&SERVICE(tcp, 873)'
-       }
-}
-

diff --git a/modules/roles/files/backports_master/rsyncd.conf b/modules/roles/files/backports_master/rsyncd.conf
new file mode 100644 (file)
index 0000000..ed79313
--- /dev/null
+++ b/modules/roles/files/backports_master/rsyncd.conf
@@ -0,0 +1,21 @@
+uid = nobody
+gid = nogroup
+max connections = 20
+syslog facility = daemon
+log file = /var/log/rsyncd/rsyncd.log
+socket options = SO_KEEPALIVE
+timeout = 7200
+
+[debian-backports]
+  path = /srv/backports-master.debian.org/mirror
+  comment = Debian backports archive
+  read only = true
+  auth users = *
+  secrets file = /etc/rsyncd/ftp.secrets
+
+[exports]
+  path = /srv/backports-web.debian.org/export
+  comment = Various metadata exports
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/exports.secrets

diff --git a/modules/roles/files/bugs_search/rsyncd.conf b/modules/roles/files/bugs_search/rsyncd.conf
new file mode 100644 (file)
index 0000000..008e1b1
--- /dev/null
+++ b/modules/roles/files/bugs_search/rsyncd.conf
@@ -0,0 +1,29 @@
+uid = nobody
+gid = nogroup
+max connections = 20
+syslog facility = daemon
+socket options = SO_KEEPALIVE
+timeout = 7200
+log file = /var/log/rsyncd/rsyncd.log
+
+[bts-spool-db]
+  comment = [bugs-mirror.debian.org] active bug spool
+  path = /srv/bugs.debian.org/spool/db-h
+  read only = true
+
+[bts-spool-archive]
+  comment = [bugs-mirror.debian.org] archived bug spool
+  path = /srv/bugs.debian.org/spool/archive
+  read only = true
+
+[bts-spool-index]
+  comment = [bugs-mirror.debian.org] bug index files
+  path = /srv/bugs.debian.org/spool
+  exclude = db-h archive
+  read only = true
+
+[bts-versions]
+  comment = [bugs-mirror.debian.org] bts package version information
+  path = /srv/bugs.debian.org/versions
+  exclude = archive cl-data lock queue bin
+  read only = true

diff --git a/modules/roles/files/dakmaster/rsyncd.conf b/modules/roles/files/dakmaster/rsyncd.conf
new file mode 100644 (file)
index 0000000..d8d6a57
--- /dev/null
+++ b/modules/roles/files/dakmaster/rsyncd.conf
@@ -0,0 +1,106 @@
+uid = nobody
+gid = nogroup
+max connections = 25
+syslog facility = daemon
+socket options = SO_KEEPALIVE
+timeout = 7200
+log file = /var/log/rsyncd/rsyncd.log
+
+[indices]
+  path = /srv/ftp.debian.org/mirror/indices
+  comment = index files
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/indices.secrets
+
+[ftp]
+  path = /srv/ftp.debian.org/rsync/all
+  comment = Full Debian FTP Archive (~450 GB)
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/ftp.secrets
+  list = no
+
+[debian-all]
+  path = /srv/ftp.debian.org/rsync/all
+  comment = Full Debian FTP Archive (~450 GB)
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/ftp.secrets
+  list = no
+
+[debian]
+  path = /srv/ftp.debian.org/rsync/all
+  comment = Full Debian FTP Archive (~450 GB)
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/ftp.secrets
+
+[buildd-unstable]
+  path = /srv/incoming.debian.org/dists/unstable/current/
+  comment = Buildd directory unstable
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no
+
+[buildd-sid]
+  path = /srv/incoming.debian.org/dists/unstable/current/
+  comment = Buildd directory unstable
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no
+
+[buildd-experimental]
+  path = /srv/incoming.debian.org/dists/experimental/current/
+  comment = Buildd directory experimental
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no
+
+[buildd-rc-buggy]
+  path = /srv/incoming.debian.org/dists/experimental/current/
+  comment = Buildd directory experimental
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no
+
+[exports]
+  path = /srv/ftp.debian.org/rsync/export
+  comment = Various metadata exports
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/exports.secrets
+
+# disabled 20091024 RT#1864
+#[debian]
+#  path = /srv/ftp.debian.org/rsync/typical
+#  comment = Typical Debian FTP Archive (~150 GB)
+#  auth users = *
+#  read only = true
+#  secrets file = /etc/rsyncd/ftp.secrets
+#
+#[debian-all+typical]
+#  path = /srv/ftp.debian.org/rsync/all+typical
+#  comment = Debian 'all' and 'typical' FTP Archive (NB: use rsync with -H)
+#  auth users = *
+#  read only = true
+#  secrets file = /etc/rsyncd/ftp.secrets
+
+[buildd-keyrings]
+  path = /srv/ftp-master.debian.org/scripts/builddkeyrings/keyrings
+  comment = buildd keys for archive uploads
+  read only = true
+  list = no
+  hosts allow = 82.195.75.106, 2001:41b8:202:deb:216:36ff:fe40:3906
+
+[buildd-all]
+  path = /srv/incoming.debian.org/dists/
+  comment = buildd tree sync for geodns
+  read only = true
+  list = no
+  auth users = *
+  secrets file = /etc/rsyncd/buildd-all.secrets

diff --git a/modules/roles/files/keyring/rsyncd.conf b/modules/roles/files/keyring/rsyncd.conf
new file mode 100644 (file)
index 0000000..e97db76
--- /dev/null
+++ b/modules/roles/files/keyring/rsyncd.conf
@@ -0,0 +1,14 @@
+uid = nobody
+gid = nogroup
+max connections = 25
+syslog facility = daemon
+log file = /var/log/rsyncd/rsyncd.log
+socket options = SO_KEEPALIVE
+timeout = 7200
+
+[keyrings]
+  path = /org/keyring.debian.org/pub
+  exclude = keyrings-new/incoming/
+  comment = Debian Keyrings
+  read only = true
+

diff --git a/modules/roles/files/security_master/rsyncd.conf b/modules/roles/files/security_master/rsyncd.conf
new file mode 100644 (file)
index 0000000..a5cea76
--- /dev/null
+++ b/modules/roles/files/security_master/rsyncd.conf
@@ -0,0 +1,43 @@
+uid = nobody
+gid = nogroup
+max connections = 20
+syslog facility = daemon
+socket options = SO_KEEPALIVE
+timeout = 7200
+log file = /var/log/rsyncd/rsyncd.log
+
+[debian-security]
+  path = /srv/security.debian.org/archive/debian-security/
+  comment = Debian security archive
+  read only = true
+
+[exports]
+  path = /srv/security.debian.org/rsync/export
+  comment = Various metadata exports
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/exports.secrets
+
+[buildd-lenny]
+  path = /srv/security-master.debian.org/buildd/lenny/
+  comment = Buildd directory oldstable security
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no
+
+[buildd-squeeze]
+  path = /srv/security-master.debian.org/buildd/squeeze/
+  comment = Buildd directory stable security
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no
+
+[buildd-wheezy]
+  path = /srv/security-master.debian.org/buildd/wheezy/
+  comment = Buildd directory testing security
+  auth users = *
+  read only = true
+  secrets file = /etc/rsyncd/buildd.secrets
+  list = no

diff --git a/modules/roles/files/security_mirror/rsyncd.conf b/modules/roles/files/security_mirror/rsyncd.conf
new file mode 100644 (file)
index 0000000..d419156
--- /dev/null
+++ b/modules/roles/files/security_mirror/rsyncd.conf
@@ -0,0 +1,15 @@
+uid = nobody
+gid = nogroup
+max connections = 20
+syslog facility = daemon
+socket options = SO_KEEPALIVE
+timeout = 1200
+
+# weasel 2007-11-19
+log file =  /var/log/rsyncd/rsyncd.log
+
+[debian-security]
+  path = /org/ftp.root/debian-security
+  comment = Debian security archive
+  read only = true
+

diff --git a/modules/roles/files/www_master/rsyncd.conf b/modules/roles/files/www_master/rsyncd.conf
new file mode 100644 (file)
index 0000000..7ff52ac
--- /dev/null
+++ b/modules/roles/files/www_master/rsyncd.conf
@@ -0,0 +1,14 @@
+uid = nobody
+gid = nogroup
+max connections = 20
+syslog facility = daemon
+socket options = SO_KEEPALIVE
+timeout = 7200
+log file = /var/log/rsyncd/rsyncd.log
+
+[web.debian.org]
+       path = /srv/www.debian.org/www
+       comment = Debian Web Site
+       auth users = *
+       read only = true
+       secrets file = /etc/rsyncd/www.secrets

diff --git a/modules/roles/manifests/backports_master.pp b/modules/roles/manifests/backports_master.pp
index 44c5d44962fdbca3f640ac148a0213a324d17db9..98f927e864e89de27c9a86d27afe6a102266b99f 100644 (file)
--- a/modules/roles/manifests/backports_master.pp
+++ b/modules/roles/manifests/backports_master.pp
@@ -9,4 +9,9 @@ class roles::backports_master {
                chown_user => dak,
                root       => '/srv/backports-upload',
        }
+
+       rsync::site { 'backports_master':
+               source        => 'puppet:///modules/roles/backports_master/rsyncd.conf',
+               max_clients => 100,
+       }
 }

diff --git a/modules/roles/manifests/bugs_search.pp b/modules/roles/manifests/bugs_search.pp
new file mode 100644 (file)
index 0000000..9be0a9c
--- /dev/null
+++ b/modules/roles/manifests/bugs_search.pp
@@ -0,0 +1,7 @@
+class roles::bugs_search {
+
+       rsync::site { 'bugs_search':
+               source      => 'puppet:///modules/roles/bugs_search/rsyncd.conf',
+               max_clients => 100,
+       }
+}

diff --git a/modules/roles/manifests/ftp_master.pp b/modules/roles/manifests/ftp_master.pp
new file mode 100644 (file)
index 0000000..259333e
--- /dev/null
+++ b/modules/roles/manifests/ftp_master.pp
@@ -0,0 +1,7 @@
+class roles::ftp_master {
+
+       rsync::site { 'dakmaster':
+               source        => 'puppet:///modules/roles/dakmaster/rsyncd.conf',
+               max_clients => 100,
+       }
+}

diff --git a/modules/roles/manifests/init.pp b/modules/roles/manifests/init.pp
index 2bdae0d38f7e9581d4cf82ae9572039baeb8a675..a8f745ab1dddcb2596c3cce4311a239c6acf4efc 100644 (file)
--- a/modules/roles/manifests/init.pp
+++ b/modules/roles/manifests/init.pp
@@ -16,7 +16,12 @@ class roles {
                include buildd
        }
 
+       if getfromhash($site::nodeinfo, 'bugs_search') {
+               include roles::bugs_search
+       }
+
        if getfromhash($site::nodeinfo, 'ftp_master') {
+               include roles::ftp_master
                include roles::dakmaster
        }
 
@@ -50,6 +55,14 @@ class roles {
                include roles::dakmaster
        }
 
+       if getfromhash($site::nodeinfo, 'www_master') {
+               include roles::www_master
+       }
+
+       if getfromhash($site::nodeinfo, 'keyring') {
+               include roles::keyring
+       }
+
        if getfromhash($site::nodeinfo, 'apache2_ftp-upcoming_mirror') {
                include roles::ftp-upcoming_mirror
        }

diff --git a/modules/roles/manifests/keyring.pp b/modules/roles/manifests/keyring.pp
new file mode 100644 (file)
index 0000000..eb40c83
--- /dev/null
+++ b/modules/roles/manifests/keyring.pp
@@ -0,0 +1,5 @@
+class roles::keyring {
+       rsync::site { 'keyring':
+               source => 'puppet:///modules/roles/keyring/rsyncd.conf',
+       }
+}

diff --git a/modules/roles/manifests/security_master.pp b/modules/roles/manifests/security_master.pp
index 3f1b70cebd4dd8738999742b1de9f0c0c09d5513..036f0599001b009f7699d54beeb1647c016831bb 100644 (file)
--- a/modules/roles/manifests/security_master.pp
+++ b/modules/roles/manifests/security_master.pp
@@ -7,4 +7,9 @@ class roles::security_master {
                chown_user => dak,
                root       => '/srv/ftp.root/',
        }
+
+       rsync::site { 'security_master':
+               source        => 'puppet:///modules/roles/security_master/rsyncd.conf',
+               max_clients => 100,
+       }
 }

diff --git a/modules/roles/manifests/security_mirror.pp b/modules/roles/manifests/security_mirror.pp
index 4608f6d5ded616425cc5e6543d9e97174e14341a..9b85cb5f6c54d26f51ca7cd1e3140eb6b3e35916 100644 (file)
--- a/modules/roles/manifests/security_mirror.pp
+++ b/modules/roles/manifests/security_mirror.pp
@@ -11,4 +11,9 @@ class roles::security_mirror {
                max_clients  => 200,
                root         => '/srv/ftp.root/',
        }
+
+       rsync::site { 'security':
+               source      => 'puppet:///modules/roles/security_mirror/rsyncd.conf',
+               max_clients => 100,
+       }
 }

diff --git a/modules/roles/manifests/www_master.pp b/modules/roles/manifests/www_master.pp
new file mode 100644 (file)
index 0000000..856721c
--- /dev/null
+++ b/modules/roles/manifests/www_master.pp
@@ -0,0 +1,6 @@
+class roles::www_master {
+               rsync::site { 'www_master':
+                       source => 'puppet:///modules/roles/www_master/rsyncd.conf',
+               }
+
+}

diff --git a/modules/rsync/files/logrotate.d-dsa-rsyncd b/modules/rsync/files/logrotate.d-dsa-rsyncd
new file mode 100644 (file)
index 0000000..405039d
--- /dev/null
+++ b/modules/rsync/files/logrotate.d-dsa-rsyncd
@@ -0,0 +1,14 @@
+##
+## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
+## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
+##
+
+/var/log/rsyncd/*.log {
+        daily
+        missingok
+        rotate 56
+        compress
+        delaycompress
+        notifempty
+        create 644 root root
+}

diff --git a/modules/rsync/manifests/init.pp b/modules/rsync/manifests/init.pp
new file mode 100644 (file)
index 0000000..7671c6f
--- /dev/null
+++ b/modules/rsync/manifests/init.pp
@@ -0,0 +1,31 @@
+class rsync {
+
+       package { 'rsync':
+               ensure => installed,
+               noop   => true,
+       }
+
+       service { 'rsync':
+               ensure  => stopped,
+               noop    => true,
+               require => Package['rsync'],
+       }
+
+       file { '/etc/logrotate.d/dsa-rsyncd':
+               source  => 'puppet:///modules/rsyncd-log/logrotate.d-dsa-rsyncd',
+               noop    => true,
+               require => Package['debian.org'],
+       }
+       file { '/var/log/rsyncd':
+               ensure => directory,
+               noop   => true,
+               mode   => '0755',
+       }
+
+       @ferm::rule { 'dsa-rsync':
+               domain      => '(ip ip6)',
+               description => 'Allow rsync access',
+               rule        => '&SERVICE(tcp, 873)'
+       }
+
+}

diff --git a/modules/rsync/manifests/site.pp b/modules/rsync/manifests/site.pp
new file mode 100644 (file)
index 0000000..13d90dc
--- /dev/null
+++ b/modules/rsync/manifests/site.pp
@@ -0,0 +1,47 @@
+define rsync::site (
+       $bind='',
+       $source='',
+       $content='',
+       $fname='/etc/rsyncd.conf',
+       $max_clients=200,
+       $ensure=present
+){
+
+       include rsync
+
+       case $ensure {
+               present,absent: {}
+               default: { fail ( "Invald ensure `${ensure}' for ${name}" ) }
+       }
+
+       if ($source and $content) {
+               fail ( "Can't define both source and content for ${name}" )
+       }
+
+       if $source {
+               file { $fname:
+                       ensure => $ensure,
+                       source => $source
+               }
+       } elsif $content {
+               file { $fname:
+                       ensure  => $ensure,
+                       content => $content,
+               }
+       } else {
+               fail ( "Can't find config for ${name}" )
+       }
+
+       xinetd::service { "rsync-${name}":
+               bind        => $bind,
+               id          => "${name}-rsync",
+               server      => '/usr/sbin/rsyncd',
+               port        => 'rsync',
+               server_args => $fname,
+               ferm        => false,
+               instances   => $max_clients,
+               require     => File[$fname]
+       }
+
+       Service['rsync']->Service['xinetd']
+}

diff --git a/modules/rsyncd-log/files/logrotate.d-dsa-rsyncd b/modules/rsyncd-log/files/logrotate.d-dsa-rsyncd
deleted file mode 100644 (file)
index 405039d..0000000
--- a/modules/rsyncd-log/files/logrotate.d-dsa-rsyncd
+++ /dev/null
@@ -1,14 +0,0 @@
-##
-## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
-## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
-##
-
-/var/log/rsyncd/*.log {
-        daily
-        missingok
-        rotate 56
-        compress
-        delaycompress
-        notifempty
-        create 644 root root
-}

diff --git a/modules/rsyncd-log/manifests/init.pp b/modules/rsyncd-log/manifests/init.pp
deleted file mode 100644 (file)
index 0ae5951..0000000
--- a/modules/rsyncd-log/manifests/init.pp
+++ /dev/null
@@ -1,10 +0,0 @@
-class rsyncd-log {
-       file { '/etc/logrotate.d/dsa-rsyncd':
-               source  => 'puppet:///modules/rsyncd-log/logrotate.d-dsa-rsyncd',
-               require => Package['debian.org'],
-       }
-       file { '/var/log/rsyncd':
-               ensure  => directory,
-               mode    => '0755',
-       }
-}