modules/ferm/templates/me.conf.erb

   1 ##
   2 ## THIS FILE IS UNDER PUPPET CONTROL. DON'T EDIT IT HERE.
   3 ## USE: git clone git+ssh://$USER@puppet.debian.org/srv/puppet.debian.org/git/dsa-puppet.git
   4 ##
   5
   6 <%=
   7 nodeinfo = scope.lookupvar('deprecated::nodeinfo')
   8 out = []
   9
  10 restricted_purposes = ['kvm host', 'ganeti/kvm host', 'central syslog server', 'puppet master', 'jumphost', 'buildd', 'static-mirror', 'anycast mirror']
  11 restrict_ssh = %w{tchaikovsky draghi adayevskaya static-master-grnet-01 static-master-ubc-01 geo1 geo2 geo3 denis}
  12
  13 if (nodeinfo['ldap'].has_key?('purpose')) then
  14         nodeinfo['ldap']['purpose'].each do |purp|
  15                 if restricted_purposes.include?(purp) then
  16                         restrict_ssh << @hostname
  17                 end
  18         end
  19 end
  20
  21 sshallowed = []
  22
  23 should_restrict = restrict_ssh.include?(@hostname)
  24
  25 if should_restrict then
  26         # draghi makes for a nice jumphost
  27         sshallowed << %w{$DSA_IPS 82.195.75.106 2001:41b8:202:deb:1a1a:0:52c3:4b6a}
  28
  29         if %w{draghi}.include?(@hostname) then
  30                 sshallowed << '$HOST_DEBIAN'
  31         end
  32
  33         if %w{adayevskaya}.include?(@hostname) then
  34                 out << '@def $MFL_LOCAL = ( 130.83.226.60 );' # Michael Fladerer
  35                 sshallowed << '$MFL_LOCAL'
  36                 sshallowed << %w{$HOST_DEBIAN}
  37         end
  38 end
  39 if sshallowed.length == 0 then
  40   sshallowed << '0.0.0.0/0'
  41   sshallowed << '::/0'
  42 end
  43
  44 out << "@def $SSH_SOURCES    = ( $SSH_SOURCES    #{sshallowed.join(' ')});"
  45
  46
  47 out.join("\n")
  48 %>