X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Froles%2Fmanifests%2Fpubsub.pp;h=94a5116ebc51868712c5f25acba816ae8a5bad95;hb=d7e050f56b61ddc883f8328f17933d1d1f94dc9a;hp=20a3bb5a26ebed192e69ad14e03a119cc5aaa88e;hpb=a1853b6ae631104132ba199df406416dd94836cd;p=mirror%2Fdsa-puppet.git

diff --git a/modules/roles/manifests/pubsub.pp b/modules/roles/manifests/pubsub.pp
index 20a3bb5a2..94a5116eb 100644
--- a/modules/roles/manifests/pubsub.pp
+++ b/modules/roles/manifests/pubsub.pp
@@ -1,8 +1,10 @@
 class roles::pubsub {
 	include roles::pubsub::params
 
-	$cluster_cookie = $roles::pubsub::params::cluster_cookie
-	$admin_password = $roles::pubsub::params::admin_password
+	$cluster_cookie  = $roles::pubsub::params::cluster_cookie
+	$admin_password  = $roles::pubsub::params::admin_password
+	$ftp_password    = $roles::pubsub::params::ftp_password
+	$buildd_password = $roles::pubsub::params::ftp_password
 	$cc_master      = rainier
 	$cc_secondary   = rapoport
 
@@ -17,17 +19,48 @@ class roles::pubsub {
 		master            => $cc_master,
 	}
 
+	user { 'rabbitmq':
+		groups => 'ssl-cert'
+	}
+
+	concat::fragment { 'rabbit_ssl':
+		target => '/etc/rabbitmq/rabbitmq.config',
+		order  => 35,
+		source => 'puppet:///modules/roles/pubsub/rabbitmq.config'
+	}
+
 	rabbitmq_user { 'admin':
 		admin    => true,
 		password => $admin_password,
 		provider => 'rabbitmqctl',
 	}
 
+	rabbitmq_user { 'ftpteam':
+		admin    => true,
+		password => $ftp_password,
+		provider => 'rabbitmqctl',
+	}
+
 	rabbitmq_vhost { 'packages':
 		ensure   => present,
 		provider => 'rabbitmqctl',
 	}
 
+	rabbitmq_vhost { 'buildd':
+		ensure   => present,
+		provider => 'rabbitmqctl',
+	}
+
+	rabbitmq_user_permissions { 'admin@buildd':
+		configure_permission => '.*',
+		read_permission      => '.*',
+		write_permission     => '.*',
+		provider             => 'rabbitmqctl',
+		require              => [
+			Rabbitmq_user['admin'],
+			Rabbitmq_vhost['buildd']
+		]
+	}
 	rabbitmq_user_permissions { 'admin@packages':
 		configure_permission => '.*',
 		read_permission      => '.*',
@@ -46,4 +79,97 @@ class roles::pubsub {
 		provider             => 'rabbitmqctl',
 		require              => Rabbitmq_user['admin']
 	}
+
+	rabbitmq_user_permissions { 'ftpteam@packages':
+		configure_permission => '.*',
+		read_permission      => '.*',
+		write_permission     => '.*',
+		provider             => 'rabbitmqctl',
+		require              => [
+			Rabbitmq_user['ftpteam'],
+			Rabbitmq_vhost['packages']
+		]
+	}
+
+	rabbitmq_user_permissions { 'buildd@buildd':
+		configure_permission => '.*',
+		read_permission      => '.*',
+		write_permission     => '.*',
+		provider             => 'rabbitmqctl',
+		require              => [
+			Rabbitmq_user['buildd'],
+			Rabbitmq_vhost['buildd']
+		]
+	}
+
+	rabbitmq_policy { 'mirror-buildd':
+		vhost   => 'buildd',
+		match   => '.*',
+		policy  => '{"ha-mode":"all"}',
+		require => Rabbitmq_vhost['buildd']
+	}
+
+	rabbitmq_policy { 'mirror-packages':
+		vhost   => 'packages',
+		match   => '.*',
+		policy  => '{"ha-mode":"all"}',
+		require => Rabbitmq_vhost['packages']
+	}
+
+	rabbitmq_plugin { 'rabbitmq_management':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+	rabbitmq_plugin { 'rabbitmq_management_agent':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+	rabbitmq_plugin { 'rabbitmq_tracing':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+	rabbitmq_plugin { 'rabbitmq_management_visualiser':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+
+	@ferm::rule { 'rabbitmq':
+		description => 'rabbitmq connections',
+		rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V4)'
+	}
+
+	@ferm::rule { 'rabbitmq-v6':
+		domain      => 'ip6',
+		description => 'rabbitmq connections',
+		rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V6)'
+	}
+
+	if $::hostname == $cc_master {
+		$you = $cc_secondary
+	} else {
+		$you = $cc_master
+	}
+
+	@ferm::rule { 'rabbitmq_cluster':
+		domain      => '(ip ip6)',
+		description => 'rabbitmq cluster connections',
+		rule        => "proto tcp mod state state (NEW) saddr (${you}) ACCEPT"
+	}
+	@ferm::rule { 'rabbitmq_mgmt':
+		description => 'rabbitmq cluster connections',
+		rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_IPS)'
+	}
+	@ferm::rule { 'rabbitmq_mgmt_v6':
+		domain      => '(ip6)',
+		description => 'rabbitmq cluster connections',
+		rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_V6_IPS)'
+	}
 }