X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Frsync%2Fmanifests%2Fsite.pp;h=7011787f3f5bb7d0dacf45e6a9259d30bd69cc80;hb=0d7a7ecc227c6a5f86081b4abb494daa4fdc713e;hp=97dbb05d872f40139c6ba6777c58cc9ab30d0fad;hpb=94eb0fe06f5deafe086b3f6f18bfd5aab2a6e069;p=mirror%2Fdsa-puppet.git

diff --git a/modules/rsync/manifests/site.pp b/modules/rsync/manifests/site.pp
index 97dbb05d8..7011787f3 100644
--- a/modules/rsync/manifests/site.pp
+++ b/modules/rsync/manifests/site.pp
@@ -1,108 +1,129 @@
 define rsync::site (
-	$bind='',
-	$bind6='',
-	$source='',
-	$content='',
-	$fname='',
+	$binds=['[::]'],
+	$source=undef,
+	$content=undef,
 	$max_clients=200,
 	$ensure=present,
-	$sslname='',
-	$sslport=1873
-){
-
+	$sslname=undef,
+) {
 	include rsync
 
-	if ! $fname {
-		$fname_real = "/etc/rsyncd-${name}.conf"
-	} else {
-		$fname_real = $fname
-	}
+	$fname_real_rsync = "/etc/rsyncd-${name}.conf"
+	$fname_real_stunnel = "/etc/rsyncd-${name}-stunnel.conf"
+
 	case $ensure {
 		present,absent: {}
 		default: { fail ( "Invald ensure `${ensure}' for ${name}" ) }
 	}
 
-	if ($source and $content) {
-		fail ( "Can't define both source and content for ${name}" )
+	$ensure_service = $ensure ? {
+		present => running,
+		absent  => stopped,
 	}
 
-	if $source {
-		file { $fname_real:
-			ensure => $ensure,
-			source => $source
-		}
-	} elsif $content {
-		file { $fname_real:
-			ensure  => $ensure,
-			content => $content,
-		}
-	} else {
-		fail ( "Can't find config for ${name}" )
+	$ensure_enable = $ensure ? {
+		present => true,
+		absent  => false,
+	}
+
+	file { $fname_real_rsync:
+		ensure  => $ensure,
+		content => $content,
+		source  => $source,
+		owner   => 'root',
+		group   => 'root',
+		mode    => '0444',
+	}
+
+	file { "/etc/systemd/system/rsyncd-${name}@.service":
+		ensure  => $ensure,
+		content => template('rsync/systemd-rsyncd.service.erb'),
+		owner   => 'root',
+		group   => 'root',
+		mode    => '0444',
+		require => File[$fname_real_rsync],
+		notify  => Exec['systemctl daemon-reload'],
+	}
+
+	file { "/etc/systemd/system/rsyncd-${name}.socket":
+		ensure  => $ensure,
+		content => template('rsync/systemd-rsyncd.socket.erb'),
+		owner   => 'root',
+		group   => 'root',
+		mode    => '0444',
+		notify  => [
+			Exec['systemctl daemon-reload'],
+			Service["rsyncd-${name}.socket"],
+		],
 	}
 
-	xinetd::service { "rsync-${name}":
-		bind        => $bind,
-		id          => "${name}-rsync",
-		server      => '/usr/bin/rsync',
-		service     => 'rsync',
-		server_args => "--daemon --config=${fname_real}",
-		ferm        => false,
-		instances   => $max_clients,
-		require     => File[$fname_real]
+	service { "rsyncd-${name}.socket":
+		ensure   => $ensure_service,
+		enable   => $ensure_enable,
+		require  => [
+			Exec['systemctl daemon-reload'],
+			File["/etc/systemd/system/rsyncd-${name}@.service"],
+			File["/etc/systemd/system/rsyncd-${name}.socket"],
+		],
+		provider => systemd,
 	}
 
-	if $bind6 != '' {
-		if $bind == '' {
-			fail("Cannot listen on * and a specific ipv6 address")
+	if $sslname {
+		file { $fname_real_stunnel:
+			ensure  => $ensure,
+			content => template('rsync/systemd-rsyncd-stunnel.conf.erb'),
+			owner   => 'root',
+			group   => 'root',
+			mode    => '0444',
+			require => File["/etc/ssl/debian/certs/${sslname}.crt-chained"],
 		}
-		xinetd::service { "rsync-${name}6":
-			bind        => $bind6,
-			id          => "${name}-rsync6",
-			server      => '/usr/bin/rsync',
-			service     => 'rsync',
-			server_args => "--daemon --config=${fname_real}",
-			ferm        => false,
-			instances   => $max_clients,
-			require     => File[$fname_real]
+
+		file { "/etc/systemd/system/rsyncd-${name}-stunnel@.service":
+			ensure  => $ensure,
+			content => template('rsync/systemd-rsyncd-stunnel.service.erb'),
+			owner   => 'root',
+			group   => 'root',
+			mode    => '0444',
+			require => File[$fname_real_stunnel],
+			notify  => Exec['systemctl daemon-reload'],
 		}
-	}
 
-	if $sslname != '' {
-		file { "/etc/rsyncd-${name}-stunnel.conf":
-			content => template('rsync/rsyncd-stunnel.conf.erb')
+		file { "/etc/systemd/system/rsyncd-${name}-stunnel.socket":
+			ensure  => $ensure,
+			content => template('rsync/systemd-rsyncd-stunnel.socket.erb'),
+			owner   => 'root',
+			group   => 'root',
+			mode    => '0444',
+			notify  => [
+				Exec['systemctl daemon-reload'],
+				Service["rsyncd-${name}-stunnel.socket"]
+			],
 		}
+
+		service { "rsyncd-${name}-stunnel.socket":
+			ensure   => $ensure_service,
+			enable   => $ensure_enable,
+			require  => [
+				Exec['systemctl daemon-reload'],
+				File["/etc/systemd/system/rsyncd-${name}-stunnel@.service"],
+				File["/etc/systemd/system/rsyncd-${name}-stunnel.socket"],
+				Service["rsyncd-${name}.socket"],
+			],
+			provider => systemd,
+		}
+
 		@ferm::rule { "rsync-${name}-ssl":
 			domain      => '(ip ip6)',
 			description => 'Allow rsync access',
-			rule        => "&SERVICE(tcp, $sslport)",
-		}
-		xinetd::service { "rsync-${name}-ssl":
-			bind        => $bind,
-			id          => "rsync-${name}-ssl",
-			server      => '/usr/bin/stunnel4',
-			server_args => "/etc/rsyncd-${name}-stunnel.conf",
-			service     => "rsync-ssl",
-			type        => 'UNLISTED',
-			port        => "$sslport",
-			ferm        => true,
-			instances   => $max_clients,
-			require     => File["/etc/rsyncd-${name}-stunnel.conf"],
+			rule        => '&SERVICE(tcp, 1873)',
 		}
-		if $bind6 != '' {
-			xinetd::service { "rsync-${name}-ssl6":
-				bind        => $bind6,
-				id          => "rsync-${name}-ssl6",
-				server      => '/usr/bin/stunnel4',
-				server_args => "/etc/rsyncd-${name}-stunnel.conf",
-				service     => "rsync-ssl",
-				type        => 'UNLISTED',
-				port        => "$sslport",
-				ferm        => true,
-				instances   => $max_clients,
-				require     => File["/etc/rsyncd-${name}-stunnel.conf"],
-			}
+
+		$certdir = hiera('paths.letsencrypt_dir')
+		dnsextras::tlsa_record{ "tlsa-${sslname}-1873":
+			zone     => 'debian.org',
+			certfile => [ "${certdir}/${sslname}.crt" ],
+			port     => 1873,
+			hostname => $sslname,
 		}
 	}
-
-	Service['rsync']->Service['xinetd']
 }