X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fnfs-server%2Fmanifests%2Finit.pp;h=1d9ba2cc97468433a2095b50a3ab80d376021f0d;hb=4dbb9302ed958650774c966e53e19406b1f631a3;hp=e052c71d6030cedb6502366dafcf1db90b7558fd;hpb=984b45e7c3216a85517a16992f2b7646fa696c00;p=mirror%2Fdsa-puppet.git

diff --git a/modules/nfs-server/manifests/init.pp b/modules/nfs-server/manifests/init.pp
index e052c71d6..1d9ba2cc9 100644
--- a/modules/nfs-server/manifests/init.pp
+++ b/modules/nfs-server/manifests/init.pp
@@ -4,7 +4,7 @@ class nfs-server {
 			'nfs-common',
 			'nfs-kernel-server'
 		]:
-			ensure => installed
+		ensure => installed
 	}
 
 	service { 'nfs-common':
@@ -16,43 +16,57 @@ class nfs-server {
 		status      => '/bin/true',
 	}
 
+	case $::hostname {
+		lw01,lw02,lw03,lw04: {
+			$client_range    = '10.0.0.0/8'
+		}
+		milanollo: {
+			$client_range    = '172.29.122.0/24'
+		}
+		buxtehude,glinka: {
+			$client_range    = '192.168.2.0/24'
+		}
+		default: {
+			# Better than 0.0.0.0/0 - we really ought to configure a
+			# client range for them all instead of exporting to the world.
+			$client_range    = '127.0.0.0/8'
+		}
+	}
+
 	@ferm::rule { 'dsa-portmap':
-		domain      => '(ip ip6)',
 		description => 'Allow portmap access',
-		rule        => '&TCP_UDP_SERVICE(111)'
+		rule        => "&TCP_UDP_SERVICE_RANGE(111, $client_range)"
 	}
 	@ferm::rule { 'dsa-nfs':
-		domain      => '(ip ip6)',
 		description => 'Allow nfsd access',
-		rule        => '&TCP_UDP_SERVICE(2049)'
+		rule        => "&TCP_UDP_SERVICE_RANGE(2049, $client_range)"
 	}
 	@ferm::rule { 'dsa-status':
-		domain      => '(ip ip6)',
 		description => 'Allow statd access',
-		rule        => '&TCP_UDP_SERVICE(10000)'
+		rule        => "&TCP_UDP_SERVICE_RANGE(10000, $client_range)"
 	}
 	@ferm::rule { 'dsa-mountd':
-		domain      => '(ip ip6)',
 		description => 'Allow mountd access',
-		rule        => '&TCP_UDP_SERVICE(10002)'
+		rule        => "&TCP_UDP_SERVICE_RANGE(10002, $client_range)"
 	}
 	@ferm::rule { 'dsa-lockd':
-		domain      => '(ip ip6)',
 		description => 'Allow lockd access',
-		rule        => '&TCP_UDP_SERVICE(10003)'
+		rule        => "&TCP_UDP_SERVICE_RANGE(10003, $client_range)"
 	}
 
 	file { '/etc/default/nfs-common':
 		source  => 'puppet:///modules/nfs-server/nfs-common.default',
-		require => Package['nfs-common'],
+		before  => Package['nfs-common'],
 		notify  => Service['nfs-common'],
 	}
 	file { '/etc/default/nfs-kernel-server':
 		source  => 'puppet:///modules/nfs-server/nfs-kernel-server.default',
-		require => Package['nfs-kernel-server'],
+		before  => Package['nfs-kernel-server'],
 		notify  => Service['nfs-kernel-server'],
 	}
 	file { '/etc/modprobe.d/lockd.local':
-		source => 'puppet:///modules/nfs-server/lockd.local.modprobe'
+		source => 'puppet:///modules/nfs-server/lockd.local.modprobe',
+		before => Package['nfs-common'],
+		notify => Service['nfs-common'],
 	}
 }