modules/rsync/manifests/site.pp

   1 define rsync::site (
   2         $binds=['[::]'],
   3         $source=undef,
   4         $content=undef,
   5         $max_clients=200,
   6         Enum['present','absent'] $ensure = 'present',
   7         $sslname=undef,
   8 ) {
   9         include rsync
  10
  11         $fname_real_rsync = "/etc/rsyncd-${name}.conf"
  12         $fname_real_stunnel = "/etc/rsyncd-${name}-stunnel.conf"
  13
  14         $ensure_service = $ensure ? {
  15                 present => running,
  16                 absent  => stopped,
  17         }
  18
  19         $ensure_enable = $ensure ? {
  20                 present => true,
  21                 absent  => false,
  22         }
  23
  24         file { $fname_real_rsync:
  25                 ensure  => $ensure,
  26                 content => $content,
  27                 source  => $source,
  28                 owner   => 'root',
  29                 group   => 'root',
  30                 mode    => '0444',
  31         }
  32
  33         file { "/etc/systemd/system/rsyncd-${name}@.service":
  34                 ensure  => $ensure,
  35                 content => template('rsync/systemd-rsyncd.service.erb'),
  36                 owner   => 'root',
  37                 group   => 'root',
  38                 mode    => '0444',
  39                 require => File[$fname_real_rsync],
  40                 notify  => Exec['systemctl daemon-reload'],
  41         }
  42
  43         file { "/etc/systemd/system/rsyncd-${name}.socket":
  44                 ensure  => $ensure,
  45                 content => template('rsync/systemd-rsyncd.socket.erb'),
  46                 owner   => 'root',
  47                 group   => 'root',
  48                 mode    => '0444',
  49                 notify  => Exec['systemctl daemon-reload'],
  50         }
  51
  52         service { "rsyncd-${name}.socket":
  53                 ensure   => $ensure_service,
  54                 enable   => $ensure_enable,
  55                 notify   => Exec['systemctl daemon-reload'],
  56                 subscribe => [
  57                         File["/etc/systemd/system/rsyncd-${name}@.service"],
  58                         File["/etc/systemd/system/rsyncd-${name}.socket"],
  59                 ],
  60                 provider => systemd,
  61         }
  62
  63         if $sslname {
  64                 file { $fname_real_stunnel:
  65                         ensure  => $ensure,
  66                         content => template('rsync/systemd-rsyncd-stunnel.conf.erb'),
  67                         owner   => 'root',
  68                         group   => 'root',
  69                         mode    => '0444',
  70                         require => File["/etc/ssl/debian/certs/${sslname}.crt-chained"],
  71                 }
  72
  73                 file { "/etc/systemd/system/rsyncd-${name}-stunnel@.service":
  74                         ensure  => $ensure,
  75                         content => template('rsync/systemd-rsyncd-stunnel.service.erb'),
  76                         owner   => 'root',
  77                         group   => 'root',
  78                         mode    => '0444',
  79                         require => File[$fname_real_stunnel],
  80                         notify  => Exec['systemctl daemon-reload'],
  81                 }
  82
  83                 file { "/etc/systemd/system/rsyncd-${name}-stunnel.socket":
  84                         ensure  => $ensure,
  85                         content => template('rsync/systemd-rsyncd-stunnel.socket.erb'),
  86                         owner   => 'root',
  87                         group   => 'root',
  88                         mode    => '0444',
  89                         notify  => [
  90                                 Exec['systemctl daemon-reload'],
  91                                 Service["rsyncd-${name}-stunnel.socket"]
  92                         ],
  93                 }
  94
  95                 service { "rsyncd-${name}-stunnel.socket":
  96                         ensure   => $ensure_service,
  97                         enable   => $ensure_enable,
  98                         require  => [
  99                                 Exec['systemctl daemon-reload'],
 100                                 File["/etc/systemd/system/rsyncd-${name}-stunnel@.service"],
 101                                 File["/etc/systemd/system/rsyncd-${name}-stunnel.socket"],
 102                                 Service["rsyncd-${name}.socket"],
 103                         ],
 104                         provider => systemd,
 105                 }
 106
 107                 ferm::rule { "rsync-${name}-ssl":
 108                         domain      => '(ip ip6)',
 109                         description => 'Allow rsync access',
 110                         rule        => '&SERVICE(tcp, 1873)',
 111                 }
 112
 113                 $certdir = hiera('paths.letsencrypt_dir')
 114                 dnsextras::tlsa_record{ "tlsa-${sslname}-1873":
 115                         zone     => 'debian.org',
 116                         certfile => [ "${certdir}/${sslname}.crt" ],
 117                         port     => 1873,
 118                         hostname => $sslname,
 119                 }
 120         }
 121 }