push sibelius archive rsync via puppet, make it ssl

diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index fafbeca..d806e65 100644 (file)
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -4,6 +4,8 @@ searchpaths: []
 resolvoptions: []
 allow_dns_query: []
 roles:
+  archive_master:
+    - sibelius.debian.org
   bugsmx:
     - buxtehude.debian.org
   bugs_master:

diff --git a/modules/ferm/manifests/per-host.pp b/modules/ferm/manifests/per-host.pp
index ad40eb1..3876d2a 100644 (file)
--- a/modules/ferm/manifests/per-host.pp
+++ b/modules/ferm/manifests/per-host.pp
@@ -3,7 +3,7 @@ class ferm::per-host {
                include ferm::zivit
        }
 
-       if $::hostname in [glinka,rietz,sibelius] {
+       if $::hostname in [glinka,rietz] {
                ferm::rule { 'dsa-rsync':
                        domain      => '(ip ip6)',
                        description => 'Allow rsync access',

diff --git a/modules/roles/files/archive_master/rsyncd.conf b/modules/roles/files/archive_master/rsyncd.conf
new file mode 100644 (file)
index 0000000..976bb13
--- /dev/null
+++ b/modules/roles/files/archive_master/rsyncd.conf
@@ -0,0 +1,18 @@
+uid = nobody
+gid = nogroup
+max connections = 25
+syslog facility = daemon
+socket options = SO_KEEPALIVE
+timeout = 7200
+log file = /var/log/rsyncd/rsyncd-archive.log
+
+[debian-archive]
+  path = /srv/mirrors/debian-archive
+  comment = Debian Historical Archives (use -H to save space)
+  read only = true
+
+[archive]
+  path = /srv/mirrors/debian-archive
+  comment = Debian Archive (use -H to save space)
+  read only = true
+  list = no

diff --git a/modules/roles/manifests/archive_master.pp b/modules/roles/manifests/archive_master.pp
new file mode 100644 (file)
index 0000000..04548a5
--- /dev/null
+++ b/modules/roles/manifests/archive_master.pp
@@ -0,0 +1,14 @@
+class roles::archive_master {
+       $sslname = 'archive-master.debian.org'
+
+       rsync::site { 'archive_master':
+               source        => 'puppet:///modules/roles/archive_master/rsyncd.conf',
+               max_clients   => 100,
+               sslname       => $sslname,
+       }
+
+       ssl::service { $sslname:
+               key => true,
+               tlsaport => [],
+       }
+}