dedicated ganeti ssh chain

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index 55b27e20cff336b5f02c1effd01a097a0547288c..3de244eb3f7cc5d711cbcb9b68bcaf8f5e8e8848 100644 (file)
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -37,14 +37,6 @@ if %w{geo1 geo2 geo3}.include?(hostname) then
        ssh4allowed << '194.177.211.209' # orff - master
        ssh6allowed << '2001:648:2ffc:deb:213:72ff:fe69:e188' # orff - master
 end
-if %w{pasquini tristano}.include?(hostname) then
-       ssh4allowed << '206.12.19.23'    # ganeti2.debian.org
-       ssh4allowed << '206.12.19.213'   # tristano.debian.org
-       ssh4allowed << '206.12.19.217'   # pasquini.debian.org
-       ssh4allowed << '192.168.2.23'    # ganeti2.debprivate-ubc.debian.org
-       ssh4allowed << '192.168.2.213'   # tristano-mnt.debprivate-ubc.debian.org
-       ssh4allowed << '192.168.2.217'   # pasquini-mnt.debprivate-ubc.debian.org
-end
 ssh4allowed.length == 0 and ssh4allowed << '0.0.0.0/0'
 ssh6allowed.length == 0 and ssh6allowed << '::/0'
 

diff --git a/modules/ganeti2/manifests/init.pp b/modules/ganeti2/manifests/init.pp
index 7308ca2e9e9f6d57c984934c95dff8a03dca37bf..7d44ee1da596a57c59b961f966069a38193e80dd 100644 (file)
--- a/modules/ganeti2/manifests/init.pp
+++ b/modules/ganeti2/manifests/init.pp
@@ -42,7 +42,13 @@ class ganeti2 {
 
        @ferm::rule { 'dsa-ganeti-migrate':
                description => 'allow kvm to migrate instances',
-               rule        => 'proto tcp dport 8102 @subchain \'kvm-migrate\' { saddr ($HOST_GANETI_BACKEND_V4) daddr ($HOST_GANETI_BACKEND_V4) ACCEPT; }',
+               rule        => 'proto tcp dport 8102 @subchain \'ganeti-migrate\' { saddr ($HOST_GANETI_BACKEND_V4) daddr ($HOST_GANETI_BACKEND_V4) ACCEPT; }',
+               notarule    => true,
+       }
+
+       @ferm::rule { 'dsa-ganeti-ssh':
+               description => 'allow ganeti to ssh around',
+               rule        => 'proto tcp dport ssh @subchain \'ganeti-ssh\' { saddr ( $HOST_GANETI_V4 $HOST_GANETI_BACKEND_V4) ACCEPT; }',
                notarule    => true,
        }
 }