X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fapache2%2Fmanifests%2Finit.pp;h=95ccf82db101d5c110e40e1973cd50f8197a5a69;hb=2d1ec427e3c71ed97101e3dc53b8ece95624d67f;hp=dfa4b59bca252ea730e85c2132d689da91359bfc;hpb=75c98d0f0743b4582ef62935b380cacbf252e7e0;p=mirror%2Fdsa-puppet.git

diff --git a/modules/apache2/manifests/init.pp b/modules/apache2/manifests/init.pp
index dfa4b59bc..95ccf82db 100644
--- a/modules/apache2/manifests/init.pp
+++ b/modules/apache2/manifests/init.pp
@@ -10,8 +10,24 @@
 #                                  serving static/cheap content.  If the host is very
 #                                  script heavy (say the bug tracking system), set this
 #                                  to reduce the number of worker threads.
+# @param rlimitnproc A resource limit for number of processes.  The default is usually fine.
+# @param rlimitmem   A resource limit for memory usage.  The default is usually fine.
+# @param public Whether this host's apache should be accessible from the public internet.
+#               Sets appropriate firewall rules and optionally rate limits.
+# @param mpm Which Multi-Processing Modules to use. Defaults to worker;
+#            the alternative is prefork.
+# @param rate_limit Rate limit incoming connections at the netfilter level.  If false,
+#                   (and public is true), all incoming connections to the http
+#                   and https ports get sent to the http chain, and accepted at
+#                   ferm prio 90, so other things can be done to web traffic
+#                   before that.
 class apache2(
-  Boolean $smaller_number_of_threads = false
+  Boolean $smaller_number_of_threads = false,
+  Integer $rlimitnproc = 256,
+  Integer $rlimitmem = 192 * 1024 * 1024,
+  Boolean $public = true,
+  Enum['prefork','worker'] $mpm = 'worker',
+  Boolean $rate_limit = false,
 ) {
   include webserver
 
@@ -47,26 +63,6 @@ class apache2(
     ensure => absent,
   }
 
-  if has_role('udd') {
-    $memlimit = 512 * 1024 * 1024
-  } elsif has_role('dgit_git') {
-    $memlimit = 512 * 1024 * 1024
-  } elsif has_role('sso') {
-    $memlimit = 512 * 1024 * 1024
-  } elsif has_role('popcon') {
-    $memlimit = 512 * 1024 * 1024
-  } elsif has_role('qamaster') {
-    $memlimit = 300 * 1024 * 1024
-  } else {
-    $memlimit = 192 * 1024 * 1024
-  }
-  # debbugs cgis like to fork and don't deal well with EAGAIN
-  if has_role('bugs_base') {
-    $proclimit = 450
-  } else {
-    $proclimit = 256
-  }
-
   apache2::config { 'resource-limits':
     content => template('apache2/resource-limits.erb'),
   }
@@ -108,13 +104,9 @@ class apache2(
   }
 
   apache2::module { 'mpm_event': ensure => absent }
-  if has_role('apache_prefork') {
-    apache2::module { 'mpm_worker': ensure => absent }
-    apache2::module { 'mpm_prefork': }
-  } else {
-    apache2::module { 'mpm_prefork': ensure => absent }
-    apache2::module { 'mpm_worker': }
-  }
+  apache2::module { 'mpm_worker' : ensure => ($mpm == 'worker' ) ? { true => 'present', default => absent } }
+  apache2::module { 'mpm_prefork': ensure => ($mpm == 'prefork') ? { true => 'present', default => absent } }
+
   file { '/etc/apache2/mods-available/mpm_worker.conf':
     content => template('apache2/mpm_worker.erb'),
   }
@@ -144,21 +136,23 @@ class apache2(
     ensure => installed,
   }
 
-  if (! has_role('apache_not_public')) {
-    if has_role('apache_ratelimited') {
+  if $public {
+    ferm::rule { 'dsa-http':
+      prio        => '23',
+      description => 'A web subchain',
+      domain      => '(ip ip6)',
+      rule        => 'proto tcp dport (http https 6081) jump http'
+    }
+
+    if $rate_limit {
       include apache2::dynamic
     } else {
-      ferm::rule { 'dsa-http':
-        prio        => '23',
-        description => 'Allow web access',
-        rule        => '&SERVICE(tcp, (http https))'
-      }
-
-      ferm::rule { 'dsa-http-v6':
-        domain      => '(ip6)',
-        prio        => '23',
-        description => 'Allow web access',
-        rule        => '&SERVICE(tcp, (http https))'
+      ferm::rule { 'dsa-http-allow':
+        description => 'http subchain, allow everything',
+        prio        => '90',
+        chain       => 'http',
+        domain      => '(ip ip6)',
+        rule        => 'jump ACCEPT',
       }
     }
   }
@@ -176,6 +170,6 @@ class apache2(
   }
 
   apache2::config { 'local-scheduled-shutdown':
-    source => 'puppet:///modules/apache2/local-scheduled-shutdown',
+    ensure => 'absent',
   }
 }