X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Froles%2Fmanifests%2Fpubsub.pp;h=9d0ea176fe8b03d0a00cda06059e60b1228a3558;hb=211f337f632d4369b62326c8e64b735a218badc1;hp=61a93bf3f831617318331d9b06ad8c1f9314310d;hpb=29e997fcfccb12a19b9871228005d14fc6b9189e;p=mirror%2Fdsa-puppet.git

diff --git a/modules/roles/manifests/pubsub.pp b/modules/roles/manifests/pubsub.pp
index 61a93bf3f..9d0ea176f 100644
--- a/modules/roles/manifests/pubsub.pp
+++ b/modules/roles/manifests/pubsub.pp
@@ -1,8 +1,10 @@
 class roles::pubsub {
 	include roles::pubsub::params
 
-	$cluster_cookie = $roles::pubsub::params::cluster_cookie
-	$admin_password = $roles::pubsub::params::admin_password
+	$cluster_cookie  = $roles::pubsub::params::cluster_cookie
+	$admin_password  = $roles::pubsub::params::admin_password
+	$ftp_password    = $roles::pubsub::params::ftp_password
+	$buildd_password = $roles::pubsub::params::ftp_password
 	$cc_master      = rainier
 	$cc_secondary   = rapoport
 
@@ -17,17 +19,54 @@ class roles::pubsub {
 		master            => $cc_master,
 	}
 
+	user { 'rabbitmq':
+		groups => 'ssl-cert'
+	}
+
+	concat::fragment { 'rabbit_ssl':
+		target => '/etc/rabbitmq/rabbitmq.config',
+		order  => 35,
+		source => 'puppet:///modules/roles/pubsub/rabbitmq.config'
+	}
+
 	rabbitmq_user { 'admin':
 		admin    => true,
 		password => $admin_password,
 		provider => 'rabbitmqctl',
 	}
 
+	rabbitmq_user { 'ftpteam':
+		admin    => true,
+		password => $ftp_password,
+		provider => 'rabbitmqctl',
+	}
+
+	rabbitmq_user { 'buildd':
+		admin    => true,
+		password => $buildd_password,
+		provider => 'rabbitmqctl',
+	}
+
 	rabbitmq_vhost { 'packages':
 		ensure   => present,
 		provider => 'rabbitmqctl',
 	}
 
+	rabbitmq_vhost { 'buildd':
+		ensure   => present,
+		provider => 'rabbitmqctl',
+	}
+
+	rabbitmq_user_permissions { 'admin@buildd':
+		configure_permission => '.*',
+		read_permission      => '.*',
+		write_permission     => '.*',
+		provider             => 'rabbitmqctl',
+		require              => [
+			Rabbitmq_user['admin'],
+			Rabbitmq_vhost['buildd']
+		]
+	}
 	rabbitmq_user_permissions { 'admin@packages':
 		configure_permission => '.*',
 		read_permission      => '.*',
@@ -47,15 +86,76 @@ class roles::pubsub {
 		require              => Rabbitmq_user['admin']
 	}
 
+	rabbitmq_user_permissions { 'ftpteam@packages':
+		configure_permission => '.*',
+		read_permission      => '.*',
+		write_permission     => '.*',
+		provider             => 'rabbitmqctl',
+		require              => [
+			Rabbitmq_user['ftpteam'],
+			Rabbitmq_vhost['packages']
+		]
+	}
+
+	rabbitmq_user_permissions { 'buildd@buildd':
+		configure_permission => '.*',
+		read_permission      => '.*',
+		write_permission     => '.*',
+		provider             => 'rabbitmqctl',
+		require              => [
+			Rabbitmq_user['buildd'],
+			Rabbitmq_vhost['buildd']
+		]
+	}
+
+	rabbitmq_policy { 'mirror-buildd':
+		vhost   => 'buildd',
+		match   => '.*',
+		policy  => '{"ha-mode":"all"}',
+		require => Rabbitmq_vhost['buildd']
+	}
+
+	rabbitmq_policy { 'mirror-packages':
+		vhost   => 'packages',
+		match   => '.*',
+		policy  => '{"ha-mode":"all"}',
+		require => Rabbitmq_vhost['packages']
+	}
+
+	rabbitmq_plugin { 'rabbitmq_management':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+	rabbitmq_plugin { 'rabbitmq_management_agent':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+	rabbitmq_plugin { 'rabbitmq_tracing':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+	rabbitmq_plugin { 'rabbitmq_management_visualiser':
+		ensure   => present,
+		provider => 'rabbitmqplugins',
+		require  => Package['rabbitmq-server'],
+		notify   => Service['rabbitmq-server']
+	}
+
 	@ferm::rule { 'rabbitmq':
 		description => 'rabbitmq connections',
-		rule        => '&SERVICE_RANGE(tcp, 5672, $HOST_DEBIAN_V4)'
+		rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V4)'
 	}
 
 	@ferm::rule { 'rabbitmq-v6':
 		domain      => 'ip6',
 		description => 'rabbitmq connections',
-		rule        => '&SERVICE_RANGE(tcp, 5672, $HOST_DEBIAN_V6)'
+		rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN_V6)'
 	}
 
 	if $::hostname == $cc_master {
@@ -69,4 +169,13 @@ class roles::pubsub {
 		description => 'rabbitmq cluster connections',
 		rule        => "proto tcp mod state state (NEW) saddr (${you}) ACCEPT"
 	}
+	@ferm::rule { 'rabbitmq_mgmt':
+		description => 'rabbitmq cluster connections',
+		rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_IPS)'
+	}
+	@ferm::rule { 'rabbitmq_mgmt_v6':
+		domain      => '(ip6)',
+		description => 'rabbitmq cluster connections',
+		rule        => '&SERVICE_RANGE(tcp, 15672, $DSA_V6_IPS)'
+	}
 }