modules/roles/manifests/snapshot_web.pp

   1 class roles::snapshot_web {
   2         include apache2
   3         include apache2::rewrite
   4
   5         # snapshot abusers
   6         #  61.69.254.110 - 20180705, mirroring with wget
   7         #  18.185.157.46  - 20180821 large amount of requests way too fast
   8         #  18.194.174.202 - 20180821 large amount of requests way too fast
   9         @ferm::rule { 'dsa-snapshot-abusers':
  10                 prio  => "000",
  11                 rule  => "saddr (61.69.254.110 18.185.157.46 18.194.174.202) DROP",
  12         }
  13
  14         ensure_packages ( [
  15                 "libapache2-mod-wsgi",
  16                 ], {
  17                 ensure => 'installed',
  18         })
  19
  20         apache2::site { '020-snapshot.debian.org':
  21                 site   => 'snapshot.debian.org',
  22                 content => template('roles/snapshot/snapshot.debian.org.conf.erb')
  23         }
  24
  25         case $::hostname {
  26                 'lw07': {
  27                         $ipv4addr        = '185.17.185.185'
  28                         $ipv6addr        = '2001:1af8:4020:b030:deb::185'
  29                         $ipv6addr_apache = '2001:1af8:4020:b030:deb::187'
  30                 }
  31                 'sallinen': {
  32                         $ipv4addr        = '193.62.202.27'
  33                         $ipv6addr        = '2001:630:206:4000:1a1a:0:c13e:ca1b'
  34                         $ipv6addr_apache = '2001:630:206:4000:1a1a:0:c13e:ca1a'
  35                 }
  36                 default: {
  37                         fail ( "unknown host $::hostname for snapshot_web." )
  38                 }
  39         }
  40
  41         # varnish cache
  42         ###############
  43         @ferm::rule { 'dsa-nat-snapshot-varnish-v4':
  44                 table => 'nat',
  45                 chain => 'PREROUTING',
  46                 rule  => "proto tcp daddr ${ipv4addr} dport 80 REDIRECT to-ports 6081",
  47         }
  48
  49         varnish::config { 'default':
  50                 listen  => [
  51                         ':6081',
  52                         "[$ipv6addr]:80"
  53                         ],
  54                 backend => 'file,/var/lib/varnish/varnish_storage.bin,8G',
  55                 content => template('roles/snapshot/snapshot.debian.org.vcl.erb'),
  56         }
  57
  58         # the ipv6 port 80 is owned by varnish
  59         file { '/etc/apache2/ports.conf':
  60                 content  => @("EOF"),
  61                         Listen 0.0.0.0:80
  62                         Listen [$ipv6addr_apache]:80
  63                         | EOF
  64                 require => Package['apache2'],
  65                 notify  => Service['apache2'],
  66         }
  67
  68         # haproxy ssl termination
  69         #########################
  70         include haproxy
  71         file { '/etc/haproxy/haproxy.cfg':
  72                 content => template('roles/snapshot/haproxy.cfg.erb'),
  73                 require => Package['haproxy'],
  74                 notify  => Service['haproxy'],
  75         }
  76         ssl::service { 'snapshot.debian.org':
  77                 notify  => Service['haproxy'],
  78                 key => true,
  79         }
  80 }