X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;ds=sidebyside;f=modules%2Frsync%2Fmanifests%2Fsite.pp;h=ab47a1ad3ebe66d3667c1fb97242fdc6d4d14a9f;hb=c07855af1da63b13d1789e4e235f3cab0e59aedd;hp=394b895b446af060d6e9983b2ec2393b4e563a29;hpb=effa893ba6f0fd5d351ee14fd6ef551f66e7e245;p=mirror%2Fdsa-puppet.git

diff --git a/modules/rsync/manifests/site.pp b/modules/rsync/manifests/site.pp
index 394b895b4..ab47a1ad3 100644
--- a/modules/rsync/manifests/site.pp
+++ b/modules/rsync/manifests/site.pp
@@ -1,14 +1,17 @@
 define rsync::site (
 	$bind='',
+	$bind6='',
 	$source='',
 	$content='',
-	$fname='/etc/rsyncd.conf',
 	$max_clients=200,
-	$ensure=present
+	$ensure=present,
+	$sslname='',
+	$sslport=1873
 ){
 
 	include rsync
 
+	$fname_real = "/etc/rsyncd-${name}.conf"
 	case $ensure {
 		present,absent: {}
 		default: { fail ( "Invald ensure `${ensure}' for ${name}" ) }
@@ -19,15 +22,13 @@ define rsync::site (
 	}
 
 	if $source {
-		file { $fname:
+		file { $fname_real:
 			ensure => $ensure,
-			noop   => true,
 			source => $source
 		}
 	} elsif $content {
-		file { $fname:
+		file { $fname_real:
 			ensure  => $ensure,
-			noop    => true,
 			content => $content,
 		}
 	} else {
@@ -35,15 +36,75 @@ define rsync::site (
 	}
 
 	xinetd::service { "rsync-${name}":
-		noop        => true,
 		bind        => $bind,
 		id          => "${name}-rsync",
-		server      => '/usr/sbin/rsyncd',
-		port        => 'rsync',
-		server_args => $fname,
+		server      => '/usr/bin/rsync',
+		service     => 'rsync',
+		server_args => "--daemon --config=${fname_real}",
 		ferm        => false,
 		instances   => $max_clients,
-		require     => File[$fname]
+		require     => File[$fname_real]
+	}
+
+	if $bind6 != '' {
+		if $bind == '' {
+			fail("Cannot listen on * and a specific ipv6 address")
+		}
+		xinetd::service { "rsync-${name}6":
+			bind        => $bind6,
+			id          => "${name}-rsync6",
+			server      => '/usr/bin/rsync',
+			service     => 'rsync',
+			server_args => "--daemon --config=${fname_real}",
+			ferm        => false,
+			instances   => $max_clients,
+			require     => File[$fname_real]
+		}
+	}
+
+	if $sslname != '' {
+		file { "/etc/rsyncd-${name}-stunnel.conf":
+			content => template('rsync/rsyncd-stunnel.conf.erb'),
+			require => File["/etc/ssl/debian/certs/${sslname}.crt-chained"],
+		}
+		@ferm::rule { "rsync-${name}-ssl":
+			domain      => '(ip ip6)',
+			description => 'Allow rsync access',
+			rule        => "&SERVICE(tcp, $sslport)",
+		}
+		xinetd::service { "rsync-${name}-ssl":
+			bind        => $bind,
+			id          => "rsync-${name}-ssl",
+			server      => '/usr/bin/stunnel4',
+			server_args => "/etc/rsyncd-${name}-stunnel.conf",
+			service     => "rsync-ssl",
+			type        => 'UNLISTED',
+			port        => "$sslport",
+			ferm        => true,
+			instances   => $max_clients,
+			require     => File["/etc/rsyncd-${name}-stunnel.conf"],
+		}
+		if $bind6 != '' {
+			xinetd::service { "rsync-${name}-ssl6":
+				bind        => $bind6,
+				id          => "rsync-${name}-ssl6",
+				server      => '/usr/bin/stunnel4',
+				server_args => "/etc/rsyncd-${name}-stunnel.conf",
+				service     => "rsync-ssl",
+				type        => 'UNLISTED',
+				port        => "$sslport",
+				ferm        => true,
+				instances   => $max_clients,
+				require     => File["/etc/rsyncd-${name}-stunnel.conf"],
+			}
+		}
+
+		dnsextras::tlsa_record{ "tlsa-${sslname}-${sslport}":
+			zone     => 'debian.org',
+			certfile => [ "/etc/puppet/modules/ssl/files/servicecerts/${sslname}.crt", "/etc/puppet/modules/ssl/files/from-letsencrypt/${sslname}.crt" ],
+			port     => $sslport,
+			hostname => "$sslname",
+		}
 	}
 
 	Service['rsync']->Service['xinetd']