dsa-rsync-ssl ferm on v6 also

[mirror/dsa-puppet.git] / modules / roles / manifests / syncproxy.pp

diff --git a/modules/roles/manifests/syncproxy.pp b/modules/roles/manifests/syncproxy.pp
index eefb8dc..10430c1 100644 (file)
--- a/modules/roles/manifests/syncproxy.pp
+++ b/modules/roles/manifests/syncproxy.pp
@@ -55,5 +55,42 @@ class roles::syncproxy {
                file { '/srv/www/syncproxy.debian.org/htdocs/index.html':
                        content => template('roles/syncproxy/syncproxy.debian.org-index.html.erb')
                }
+
+               file { '/etc/rsyncd-syncproxy-stunnel.conf':
+                       content => template('roles/syncproxy/rsyncd-syncproxy-stunnel.conf.erb')
+               }
+               xinetd::service { "rsync-syncproxy-ssl":
+                       bind        => $bind,
+                       id          => "syncproxy-rsync-ssl",
+                       server      => '/usr/bin/stunnel4',
+                       service     => 'rsync-ssl',
+                       type        => 'UNLISTED',
+                       port        => '1873',
+                       server_args => "/etc/rsyncd-syncproxy-stunnel.conf",
+                       ferm        => false,
+                       instances   => 50,
+                       require     => File["/etc/rsyncd-syncproxy-stunnel.conf"],
+               }
+
+               if $bind6 != '' {
+                       xinetd::service { "rsync-syncproxy-ssl6":
+                               bind        => $bind6,
+                               id          => "syncproxy-rsync-ssl",
+                               server      => '/usr/bin/stunnel4',
+                               service     => 'rsync-ssl',
+                               type        => 'UNLISTED',
+                               port        => '1873',
+                               server_args => "/etc/rsyncd-syncproxy-stunnel.conf",
+                               ferm        => false,
+                               instances   => 50,
+                               require     => File["/etc/rsyncd-syncproxy-stunnel.conf"],
+                       }
+               }
+
+               @ferm::rule { "dsa-rsync-ssl":
+                       domain      => '(ip ip6)',
+                       description => "Allow traffic to rsync ssl",
+                       rule        => "&SERVICE(tcp, 1873)"
+               }
        }
 }