Do not use sslname empty string for no ssl

[mirror/dsa-puppet.git] / modules / rsync / manifests / site.pp

diff --git a/modules/rsync/manifests/site.pp b/modules/rsync/manifests/site.pp
index 6a4284a..04c1e20 100644 (file)
--- a/modules/rsync/manifests/site.pp
+++ b/modules/rsync/manifests/site.pp
@@ -1,20 +1,17 @@
 define rsync::site (
        $bind='',
        $bind6='',
-       $source='',
-       $content='',
-       $fname='',
+       $source=undef,
+       $content=undef,
        $max_clients=200,
-       $ensure=present
+       $ensure=present,
+       $sslname=undef,
+       $sslport=1873
 ){
 
        include rsync
 
-       if ! $fname {
-               $fname_real = "/etc/rsyncd-${name}.conf"
-       } else {
-               $fname_real = $fname
-       }
+       $fname_real = "/etc/rsyncd-${name}.conf"
        case $ensure {
                present,absent: {}
                default: { fail ( "Invald ensure `${ensure}' for ${name}" ) }
@@ -40,15 +37,75 @@ define rsync::site (
 
        xinetd::service { "rsync-${name}":
                bind        => $bind,
-               bind6       => $bind6,
                id          => "${name}-rsync",
                server      => '/usr/bin/rsync',
-               port        => 'rsync',
+               service     => 'rsync',
                server_args => "--daemon --config=${fname_real}",
                ferm        => false,
                instances   => $max_clients,
                require     => File[$fname_real]
        }
 
+       if $bind6 != '' {
+               if $bind == '' {
+                       fail("Cannot listen on * and a specific ipv6 address")
+               }
+               xinetd::service { "rsync-${name}6":
+                       bind        => $bind6,
+                       id          => "${name}-rsync6",
+                       server      => '/usr/bin/rsync',
+                       service     => 'rsync',
+                       server_args => "--daemon --config=${fname_real}",
+                       ferm        => false,
+                       instances   => $max_clients,
+                       require     => File[$fname_real]
+               }
+       }
+
+       if $sslname {
+               file { "/etc/rsyncd-${name}-stunnel.conf":
+                       content => template('rsync/rsyncd-stunnel.conf.erb'),
+                       require => File["/etc/ssl/debian/certs/${sslname}.crt-chained"],
+               }
+               @ferm::rule { "rsync-${name}-ssl":
+                       domain      => '(ip ip6)',
+                       description => 'Allow rsync access',
+                       rule        => "&SERVICE(tcp, $sslport)",
+               }
+               xinetd::service { "rsync-${name}-ssl":
+                       bind        => $bind,
+                       id          => "rsync-${name}-ssl",
+                       server      => '/usr/bin/stunnel4',
+                       server_args => "/etc/rsyncd-${name}-stunnel.conf",
+                       service     => "rsync-ssl",
+                       type        => 'UNLISTED',
+                       port        => "$sslport",
+                       ferm        => true,
+                       instances   => $max_clients,
+                       require     => File["/etc/rsyncd-${name}-stunnel.conf"],
+               }
+               if $bind6 != '' {
+                       xinetd::service { "rsync-${name}-ssl6":
+                               bind        => $bind6,
+                               id          => "rsync-${name}-ssl6",
+                               server      => '/usr/bin/stunnel4',
+                               server_args => "/etc/rsyncd-${name}-stunnel.conf",
+                               service     => "rsync-ssl",
+                               type        => 'UNLISTED',
+                               port        => "$sslport",
+                               ferm        => true,
+                               instances   => $max_clients,
+                               require     => File["/etc/rsyncd-${name}-stunnel.conf"],
+                       }
+               }
+
+               dnsextras::tlsa_record{ "tlsa-${sslname}-${sslport}":
+                       zone     => 'debian.org',
+                       certfile => [ "/etc/puppet/modules/ssl/files/servicecerts/${sslname}.crt", "/etc/puppet/modules/ssl/files/from-letsencrypt/${sslname}.crt" ],
+                       port     => $sslport,
+                       hostname => "$sslname",
+               }
+       }
+
        Service['rsync']->Service['xinetd']
 }