fix rule

[mirror/dsa-puppet.git] / modules / roles / manifests / security_tracker.pp

diff --git a/modules/roles/manifests/security_tracker.pp b/modules/roles/manifests/security_tracker.pp
index 1210c7e..eafe924 100644 (file)
--- a/modules/roles/manifests/security_tracker.pp
+++ b/modules/roles/manifests/security_tracker.pp
@@ -1,5 +1,31 @@
 class roles::security_tracker {
+       include apache2::ssl
+       include apache2::proxy_http
+       include apache2::expires
+
        ssl::service { 'security-tracker.debian.org':
-               notify => Service['apache2'],
+               notify  => Exec['service apache2 reload'],
+               key => true,
+       }
+
+       apache2::site { 'security-tracker.debian.org':
+               site   => 'security-tracker.debian.org',
+               content => template('roles/apache-security-tracker.debian.org.conf.erb')
+       }
+
+       # traffic shaping http traffic
+       @ferm::rule { 'dsa-security-tracker-shape':
+               table => 'mangle',
+               chain => 'OUTPUT',
+               rule  => "proto tcp sport 443 MARK set-mark 20",
+       }
+
+       file { '/usr/local/sbin/traffic-shape':
+               mode   => '0755',
+               content => template('roles/security-tracker/traffic-shape'),
+               notify => Exec['/usr/local/sbin/traffic-shape'],
+       }
+       exec { '/usr/local/sbin/traffic-shape':
+               refreshonly => true
        }
 }