X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fferm%2Ftemplates%2Fme.conf.erb;h=829d71aae82b9fe55da53dc79bede6e3176df92f;hb=dcd05444f7179ed841fdb1cc786b6c1931724cbd;hp=73970da0ab6e5a1945111e072aff0d8ae48d3b13;hpb=d0c098685b92334a611a0c596a35f538b95ead47;p=mirror%2Fdsa-puppet.git diff --git a/modules/ferm/templates/me.conf.erb b/modules/ferm/templates/me.conf.erb index 73970da0a..829d71aae 100644 --- a/modules/ferm/templates/me.conf.erb +++ b/modules/ferm/templates/me.conf.erb @@ -8,7 +8,7 @@ nodeinfo = scope.lookupvar('deprecated::nodeinfo') out = [] restricted_purposes = ['kvm host', 'ganeti/kvm host', 'central syslog server', 'puppet master', 'jumphost', 'buildd', 'static-mirror', 'anycast mirror'] -restrict_ssh = %w{tchaikovsky draghi adayevskaya static-master-grnet-01 static-master-ubc-01} +restrict_ssh = %w{tchaikovsky draghi adayevskaya static-master-grnet-01 static-master-ubc-01 geo1 geo2 geo3 denis} if (nodeinfo['ldap'].has_key?('purpose')) then nodeinfo['ldap']['purpose'].each do |purp| @@ -22,16 +22,12 @@ ssh4allowed = [] ssh6allowed = [] should_restrict = restrict_ssh.include?(@hostname) -%w{dns_primary dns_geo}.each do |role_restrict| - if scope.function_has_role([role_restrict]) then - should_restrict = true - end -end if should_restrict then - ssh4allowed << %w{$DSA_IPS $HOST_NAGIOS_V4 $HOST_MUNIN_V4 $HOST_DB_V4} - ssh6allowed << %w{$DSA_V6_IPS $HOST_NAGIOS_V6 $HOST_MUNIN_V6 $HOST_DB_V6} + # draghi makes for a nice jumphost + ssh4allowed << %w{$DSA_IPS $HOST_NAGIOS_V4 $HOST_MUNIN_V4 82.195.75.106} + ssh6allowed << %w{$DSA_V6_IPS $HOST_NAGIOS_V6 $HOST_MUNIN_V6 2001:41b8:202:deb:1a1a:0:52c3:4b6a} if %w{draghi}.include?(@hostname) then ssh4allowed << '$HOST_DEBIAN_V4' @@ -44,39 +40,6 @@ if should_restrict then ssh4allowed << %w{$HOST_DEBIAN_V4} ssh6allowed << %w{$HOST_DEBIAN_V6} end - - if scope.function_has_role(['debian_mirror']) or - scope.function_has_role(['security_mirror']) or - scope.function_has_role(['debug_mirror']) or - scope.function_has_role(['historical_mirror']) or - scope.function_has_role(['syncproxy']) then - ssh4allowed << '$HOST_MIRRORMASTER_V4' - ssh6allowed << '$HOST_MIRRORMASTER_V6' - end - if scope.function_has_role(['debian_mirror']) or - scope.function_has_role(['syncproxy']) then - ssh4allowed << '$HOST_SYNCPROXY_V4' - ssh6allowed << '$HOST_SYNCPROXY_V6' - end - if scope.function_has_role(['security_mirror']) or - scope.function_has_role(['syncproxy']) then - ssh4allowed << '$HOST_SECMASTER_V4' - ssh6allowed << '$HOST_SECMASTER_V6' - end - if scope.function_has_role(['historical_mirror']) then - ssh4allowed << '$HOST_ARCHIVEMASTER_V4' - ssh6allowed << '$HOST_ARCHIVEMASTER_V6' - end - if scope.function_has_role(['syncproxy']) then - ssh4allowed << '$HOST_FTPMASTER_V4' - ssh6allowed << '$HOST_FTPMASTER_V6' - ssh4allowed << '$HOST_PORTSMASTER_V4' - ssh6allowed << '$HOST_PORTSMASTER_V6' - end - if scope.function_has_role(['debug_mirror']) then - ssh4allowed << '$HOST_FTPMASTER_V4' - ssh6allowed << '$HOST_FTPMASTER_V6' - end end ssh4allowed.length == 0 and ssh4allowed << '0.0.0.0/0' ssh6allowed.length == 0 and ssh6allowed << '::/0'