modules/roles/manifests/keyring.pp

   1 class roles::keyring {
   2         rsync::site { 'keyring':
   3                 source  => 'puppet:///modules/roles/keyring/rsyncd.conf',
   4                 sslname => 'keyring.debian.org',
   5         }
   6
   7         ssl::service { 'keyring.debian.org':
   8                 notify   => Exec['service apache2 reload'],
   9                 key      => true,
  10                 tlsaport => [443, 1873],
  11         }
  12
  13         include named::authoritative
  14
  15         $notify_address = join(getfromhash($site::allnodeinfo, 'denis.debian.org', 'ipHostNumber'), "  ")
  16         $notify_address_bind = join(getfromhash($site::allnodeinfo, 'denis.debian.org', 'ipHostNumber'), "; ")
  17
  18         @ferm::rule { '01-dsa-bind':
  19                 domain      => '(ip ip6)',
  20                 description => 'Allow nameserver access',
  21                 rule        => '&TCP_UDP_SERVICE_RANGE(53, ( $HOST_NAGIOS $notify_address ) )',
  22         }
  23
  24         concat::fragment { 'dsa-named-conf-puppet-misc---openpgpkey-zone':
  25                 target => '/etc/bind/named.conf.puppet-misc',
  26                 order  => '020',
  27                 content  => @("EOF"),
  28                         zone "_openpgpkey.debian.org" {
  29                                 type master;
  30                                 file "/srv/keyring.debian.org/_openpgpkey.debian.org.zone";
  31                                 allow-query { any; };
  32                                 allow-transfer {
  33                                         key tsig-denis.debian.org-kaufmann.debian.org ;
  34                                         127.0.0.1;
  35                                 };
  36                                 also-notify {
  37                                         $notify_address;
  38                                 };
  39                         };
  40                         | EOF
  41         }
  42
  43 }