more amazon networks to blacklist
[mirror/dsa-puppet.git] / modules / roles / manifests / snapshot_web.pp
1 class roles::snapshot_web {
2         include apache2
3         include apache2::rewrite
4
5         # snapshot abusers
6         #  61.69.254.110 - 20180705, mirroring with wget
7         # 20180821 large amount of requests way too fast from some amazon AWS instances
8         #  18.185.157.46
9         #  18.194.174.202
10         #  18.184.181.169
11         #  18.184.5.230
12         #  18.194.137.96
13         #  18.197.147.183
14         #  3.120.39.137
15         #  3.120.41.69
16         #  35.158.129.130
17         #  52.59.199.25
18         #  52.59.228.158
19         #  52.59.245.42
20         #  52.59.253.41
21         #  52.59.71.13
22         # 20180821 mirroring
23         #  99.137.191.34
24         # 20181110 crawler
25         #  51.15.215.91
26         # 20181222, excessive number of requests
27         #  208.91.68.213
28         # 198.11.128.0/18
29         # running jugdo against snapshot
30         #  159.226.95.0/24
31         #  84.204.194.0/24
32         #  211.13.205.0/24
33         # 20190512 tens of thousands of queries
34         #  63.32.0.0/14
35         #  54.72.0.0/15
36         #  95.115.66.23
37         #  52.192.0.0/11
38         @ferm::rule { 'dsa-snapshot-abusers':
39                 prio  => "005",
40                 rule  => "saddr (61.69.254.110 18.128.0.0/9 3.120.0.0/14 35.156.0.0/14 52.58.0.0/15 99.137.191.34 51.15.215.91 208.91.68.213 198.11.128.0/18 159.226.95.0/24 84.204.194.0/24 211.13.205.0/24 63.32.0.0/14 54.72.0.0/15 95.115.66.23 52.192.0.0/11) DROP",
41         }
42
43         ensure_packages ( [
44                 "libapache2-mod-wsgi",
45                 ], {
46                 ensure => 'installed',
47         })
48
49         apache2::site { '020-snapshot.debian.org':
50                 site   => 'snapshot.debian.org',
51                 content => template('roles/snapshot/snapshot.debian.org.conf.erb')
52         }
53
54         case $::hostname {
55                 'lw07': {
56                         $ipv4addr        = '185.17.185.185'
57                         $ipv6addr        = '2001:1af8:4020:b030:deb::185'
58                         $ipv6addr_apache = '2001:1af8:4020:b030:deb::187'
59                 }
60                 'sallinen': {
61                         $ipv4addr        = '193.62.202.27'
62                         $ipv6addr        = '2001:630:206:4000:1a1a:0:c13e:ca1b'
63                         $ipv6addr_apache = '2001:630:206:4000:1a1a:0:c13e:ca1a'
64                 }
65                 default: {
66                         fail ( "unknown host $::hostname for snapshot_web." )
67                 }
68         }
69
70         @ferm::rule { 'dsa-snapshot-connlimit':
71                 domain => '(ip ip6)',
72                 prio  => "005",
73                 rule  => "proto tcp mod state state (NEW) interface ! lo daddr (${ipv4addr} ${ipv6addr})  mod multiport destination-ports (80 443) mod connlimit connlimit-above 3 DROP;
74                           proto tcp mod state state (NEW) interface ! lo                                                dport 6081                 mod connlimit connlimit-above 3 DROP
75                            ",
76         }
77
78         # varnish cache
79         ###############
80         @ferm::rule { 'dsa-nat-snapshot-varnish-v4':
81                 table => 'nat',
82                 chain => 'PREROUTING',
83                 rule  => "proto tcp daddr ${ipv4addr} dport 80 REDIRECT to-ports 6081",
84         }
85
86         varnish::config { 'default':
87                 listen  => [
88                         ':6081',
89                         "[$ipv6addr]:80"
90                         ],
91                 backend => 'file,/var/lib/varnish/varnish_storage.bin,8G',
92                 content => template('roles/snapshot/snapshot.debian.org.vcl.erb'),
93         }
94
95         # the ipv6 port 80 is owned by varnish
96         file { '/etc/apache2/ports.conf':
97                 content  => @("EOF"),
98                         Listen 0.0.0.0:80
99                         Listen [$ipv6addr_apache]:80
100                         | EOF
101                 require => Package['apache2'],
102                 notify  => Service['apache2'],
103         }
104
105         # haproxy ssl termination
106         #########################
107         include haproxy
108         file { '/etc/haproxy/haproxy.cfg':
109                 content => template('roles/snapshot/haproxy.cfg.erb'),
110                 require => Package['haproxy'],
111                 notify  => Service['haproxy'],
112         }
113         ssl::service { 'snapshot.debian.org':
114                 notify  => Service['haproxy'],
115                 key => true,
116         }
117 }