projects
/
mirror
/
dsa-puppet.git
/ blobdiff
commit
grep
author
committer
pickaxe
?
search:
re
summary
|
shortlog
|
log
|
commit
|
commitdiff
|
tree
raw
|
inline
| side by side
restrict ssh to static-master-ubc-01 by default. we really really should move this...
[mirror/dsa-puppet.git]
/
modules
/
ferm
/
manifests
/
init.pp
diff --git
a/modules/ferm/manifests/init.pp
b/modules/ferm/manifests/init.pp
index
f33c8ba
..
781a4a1
100644
(file)
--- a/
modules/ferm/manifests/init.pp
+++ b/
modules/ferm/manifests/init.pp
@@
-7,10
+7,6
@@
# include ferm
#
class ferm {
# include ferm
#
class ferm {
- # realize (i.e. enable) all @ferm::rule virtual resources
- Ferm::Rule <| |>
- Ferm::Conf <| |>
-
File { mode => '0400' }
package { 'ferm':
File { mode => '0400' }
package { 'ferm':
@@
-28,6
+24,12
@@
class ferm {
hasstatus => false,
status => '/bin/true',
}
hasstatus => false,
status => '/bin/true',
}
+ exec {
+ "ferm reload":
+ command => "service ferm reload",
+ refreshonly => true,
+ }
+
$munin_ips = getfromhash($site::nodeinfo, 'misc', 'v4addrs')
.map |$addr| { "ip_${addr}" }
$munin_ips = getfromhash($site::nodeinfo, 'misc', 'v4addrs')
.map |$addr| { "ip_${addr}" }
@@
-40,7
+42,7
@@
class ferm {
file { '/etc/ferm':
ensure => directory,
file { '/etc/ferm':
ensure => directory,
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
require => Package['ferm'],
mode => '0755'
}
require => Package['ferm'],
mode => '0755'
}
@@
-63,38
+65,38
@@
class ferm {
file { '/etc/default/ferm':
source => 'puppet:///modules/ferm/ferm.default',
require => Package['ferm'],
file { '/etc/default/ferm':
source => 'puppet:///modules/ferm/ferm.default',
require => Package['ferm'],
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
mode => '0444',
}
file { '/etc/ferm/ferm.conf':
content => template('ferm/ferm.conf.erb'),
mode => '0444',
}
file { '/etc/ferm/ferm.conf':
content => template('ferm/ferm.conf.erb'),
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
}
file { '/etc/ferm/conf.d/00-init.conf':
content => template('ferm/00-init.conf.erb'),
}
file { '/etc/ferm/conf.d/00-init.conf':
content => template('ferm/00-init.conf.erb'),
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
}
file { '/etc/ferm/conf.d/me.conf':
content => template('ferm/me.conf.erb'),
}
file { '/etc/ferm/conf.d/me.conf':
content => template('ferm/me.conf.erb'),
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
}
file { '/etc/ferm/conf.d/defs.conf':
content => template('ferm/defs.conf.erb'),
}
file { '/etc/ferm/conf.d/defs.conf':
content => template('ferm/defs.conf.erb'),
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
}
file { '/etc/ferm/conf.d/50-munin-interfaces.conf':
content => template('ferm/conf.d-munin-interfaces.conf.erb'),
}
file { '/etc/ferm/conf.d/50-munin-interfaces.conf':
content => template('ferm/conf.d-munin-interfaces.conf.erb'),
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
}
}
-
@
ferm::rule { 'dsa-munin-interfaces-in':
+ ferm::rule { 'dsa-munin-interfaces-in':
prio => '001',
description => 'munin accounting',
chain => 'INPUT',
domain => '(ip ip6)',
rule => 'daddr ($MUNIN_IPS) NOP'
}
prio => '001',
description => 'munin accounting',
chain => 'INPUT',
domain => '(ip ip6)',
rule => 'daddr ($MUNIN_IPS) NOP'
}
-
@
ferm::rule { 'dsa-munin-interfaces-out':
+ ferm::rule { 'dsa-munin-interfaces-out':
prio => '001',
description => 'munin accounting',
chain => 'OUTPUT',
prio => '001',
description => 'munin accounting',
chain => 'OUTPUT',
@@
-104,7
+106,7
@@
class ferm {
file { '/etc/ferm/dsa.d/010-base.conf':
content => template('ferm/dsa.d-010-base.conf.erb'),
file { '/etc/ferm/dsa.d/010-base.conf':
content => template('ferm/dsa.d-010-base.conf.erb'),
- notify =>
Service['ferm
'],
+ notify =>
Exec['ferm reload
'],
}
augeas { 'logrotate_ulogd2':
}
augeas { 'logrotate_ulogd2':