more amazon networks to blacklist
[mirror/dsa-puppet.git] / modules / roles / manifests / bgp.pp
1 class roles::bgp {
2         $bgp_peers = $::hostname ? {
3                 mirror-accumu => '2001:6b0:1e:2::1c6/128 130.242.6.198/32',
4                 mirror-skroutz => '2a03:e40:42:200::151:1/128 2a03:e40:42:200::151:2/128 154.57.0.249/32 154.57.0.250',
5                 default       => undef,
6         }
7
8         if ! $bgp_peers {
9                 fail("Do not have bgp_peers set for $::hostname.")
10         }
11
12         @ferm::rule { 'dsa-bgp':
13                 description => 'Allow BGP from peers',
14                 domain      => '(ip ip6)',
15                 rule        => "&SERVICE_RANGE(tcp, bgp, ($bgp_peers))"
16         }
17
18         file { '/etc/network/interfaces.d/anycasted':
19                 content => template('roles/anycast/interfaces.erb')
20         }
21
22 }