Switch nrpe firewalling to store/collect

[mirror/dsa-puppet.git] / modules / roles / manifests / dns_primary.pp

diff --git a/modules/roles/manifests/dns_primary.pp b/modules/roles/manifests/dns_primary.pp
index d846c1b..422db0d 100644 (file)
--- a/modules/roles/manifests/dns_primary.pp
+++ b/modules/roles/manifests/dns_primary.pp
@@ -51,4 +51,11 @@ class roles::dns_primary(
   }
   Ferm::Rule::Simple <<| tag == 'named::primary::ferm' |>>
 
+  # mini-nag does nrpe queries to check if hosts are still up
+  @@ferm::rule::simple { "dsa-nrpe-from-dnsprimary-${::fqdn}":
+    tag         => 'nagios-nrpe::server',
+    description => 'Allow dns primary running mini-nag access to the nrpe daemon',
+    port        => '5666',
+    saddr       => $base::public_addresses,
+  }
 }