}
case $::hostname {
- vittoria: {
- @ferm::rule { 'debconf17':
- description => 'temporarily allow DC17 access',
- rule => '&SERVICE_RANGE(tcp, 5432, (206.167.36.195/32))'
- }
- }
czerny,clementi: {
@ferm::rule { 'dsa-upsmon':
description => 'Allow upsmon access',
description => 'Allow syslog access',
rule => '&SERVICE_RANGE(tcp, 5140, $HOST_DEBIAN_V6)'
}
+ @ferm::rule { 'fastly-syslog':
+ description => 'Allow syslog access',
+ rule => '&SERVICE_RANGE(tcp, 5141, $HOST_FASTLY)'
+ }
}
kaufmann: {
@ferm::rule { 'dsa-hkp':
default: {}
}
- # elasticsearch stuff
- case $::hostname {
- stockhausen: {
- @ferm::rule { 'dsa-elasticsearch-bendel':
- domain => '(ip)',
- description => 'Allow elasticsearch access from bendel',
- rule => '&SERVICE_RANGE(tcp, 9200:9300, ( 82.195.75.100/32 ))'
- }
- @ferm::rule { 'dsa-elasticsearch-bendel6':
- domain => '(ip6)',
- description => 'Allow elasticsearch access from bendel',
- rule => '&SERVICE_RANGE(tcp, 9200:9300, ( 2001:41b8:202:deb:216:36ff:fe40:4002/128 ))'
- }
- }
- }
-
# postgres stuff
case $::hostname {
ullmann: {
}
danzi: {
@ferm::rule { 'dsa-postgres-danzi':
- # ubc, wuit
+ # ubc, wuiet
description => 'Allow postgress access',
rule => '&SERVICE_RANGE(tcp, 5433, ( 206.12.19.0/24 209.87.16.0/24 5.153.231.18/32 ))'
}
@ferm::rule { 'dsa-postgres2-danzi':
description => 'Allow postgress access2',
- rule => '&SERVICE_RANGE(tcp, 5437, ( 206.12.19.0/24 209.87.16.0/24 ))'
- }
- @ferm::rule { 'dsa-postgres3-danzi':
- description => 'Allow postgress access3',
- rule => '&SERVICE_RANGE(tcp, 5436, ( 206.12.19.0/24 209.87.16.0/24 ))'
+ rule => '&SERVICE_RANGE(tcp, 5434, ( 209.87.16.0/24 ))'
}
- @ferm::rule { 'dsa-postgres4-danzi':
- description => 'Allow postgress access4',
- rule => '&SERVICE_RANGE(tcp, 5438, ( 206.12.19.0/24 209.87.16.0/24 ))'
+ @ferm::rule { 'dsa-postgres2-danzi6':
+ domain => 'ip6',
+ description => 'Allow postgress access2',
+ rule => '&SERVICE_RANGE(tcp, 5434, ( 2607:f8f0:614:1::/64 ))'
}
@ferm::rule { 'dsa-postgres-backup':
description => 'Allow postgress access',
rule => '&SERVICE_RANGE(tcp, 5433, ( $HOST_PGBACKUPHOST_V6 ))'
}
+ @ferm::rule { 'dsa-postgres2-backup':
+ description => 'Allow postgress access',
+ rule => '&SERVICE_RANGE(tcp, 5434, ( $HOST_PGBACKUPHOST_V4 ))'
+ }
+ @ferm::rule { 'dsa-postgres2-backup6':
+ domain => 'ip6',
+ description => 'Allow postgress access',
+ rule => '&SERVICE_RANGE(tcp, 5434, ( $HOST_PGBACKUPHOST_V6 ))'
+ }
}
seger: {
@ferm::rule { 'dsa-postgres-backup':
rule => '&SERVICE_RANGE(tcp, 5439, ( 2001:1af8:4020:b030::/64 ))'
}
}
- melartin,vittoria: {
- @ferm::rule { 'dsa-postgres-backup':
- description => 'Allow postgress access',
- rule => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V4 ))'
- }
- @ferm::rule { 'dsa-postgres-backup6':
- domain => 'ip6',
- description => 'Allow postgress access',
- rule => '&SERVICE_RANGE(tcp, 5432, ( $HOST_PGBACKUPHOST_V6 ))'
- }
- }
- buxtehude: {
- @ferm::rule { 'dsa-postgres-backup':
- description => 'Allow postgress access',
- rule => '&SERVICE_RANGE(tcp, (5433 5441), ( $HOST_PGBACKUPHOST_V4 ))'
- }
- @ferm::rule { 'dsa-postgres-backup6':
- domain => 'ip6',
- description => 'Allow postgress access',
- rule => '&SERVICE_RANGE(tcp, (5433 5441), ( $HOST_PGBACKUPHOST_V6 ))'
- }
- }
default: {}
}
# vpn fu