retire old-style firewalling for mirrormaster sshing to the mirror nodes

[mirror/dsa-puppet.git] / modules / ferm / templates / me.conf.erb

diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb
index 072c2c0..6bd95df 100644 (file)
--- a/modules/ferm/templates/me.conf.erb
+++ b/modules/ferm/templates/me.conf.erb
@@ -41,14 +41,6 @@ if should_restrict then
                ssh6allowed << %w{$HOST_DEBIAN_V6}
        end
 
-       if scope.function_has_role(['debian_mirror']) or
-          scope.function_has_role(['security_mirror']) or
-          scope.function_has_role(['debug_mirror']) or
-          scope.function_has_role(['historical_mirror']) or
-          scope.function_has_role(['syncproxy']) then
-               ssh4allowed << '$HOST_MIRRORMASTER_V4'
-               ssh6allowed << '$HOST_MIRRORMASTER_V6'
-       end
        if scope.function_has_role(['debian_mirror']) or
           scope.function_has_role(['syncproxy']) then
                ssh4allowed << '$HOST_SYNCPROXY_V4'