Retire static_mirror_onion and move IP address lists out of static_mirror_web and...

diff --git a/hieradata/common.yaml b/hieradata/common.yaml
index b24dc1b..9cecbc9 100644 (file)
--- a/hieradata/common.yaml
+++ b/hieradata/common.yaml
@@ -99,10 +99,6 @@ roles:
     wieck.debian.org:
       service-hostname: wieck.security.backend.mirrors.debian.org
       fastly-backend: true
-  static_mirror_onion:
-    - klecker.debian.org
-    - mirror-isc.debian.org
-    - senfter.debian.org
   syncproxy:
     - gretchaninov.debian.org
     - klecker.debian.org

diff --git a/hieradata/nodes/klecker.debian.org.yaml b/hieradata/nodes/klecker.debian.org.yaml
index 4ac182c..57f87f3 100644 (file)
--- a/hieradata/nodes/klecker.debian.org.yaml
+++ b/hieradata/nodes/klecker.debian.org.yaml
@@ -6,3 +6,8 @@ classes:
 roles::ports_mirror::vhost_listen: '130.89.148.14:80 [2001:67c:2564:a119::148:14]:80'
 roles::ports_mirror::onion_service: true
 roles::ports_mirror::onion_addr: '130.89.148.14'
+
+roles::static_mirror_web::vhost_listen: '130.89.148.14:80 [2001:67c:2564:a119::148:14]:80'
+roles::static_mirror_web::vhost_listen_443: '130.89.148.14:443 [2001:67c:2564:a119::148:14]:443'
+roles::static_mirror_web::onion_service: true
+roles::static_mirror_web::onion_addr: '130.89.148.14'

diff --git a/hieradata/nodes/mirror-anu.debian.org.yaml b/hieradata/nodes/mirror-anu.debian.org.yaml
index 1a18dd4..80eda9a 100644 (file)
--- a/hieradata/nodes/mirror-anu.debian.org.yaml
+++ b/hieradata/nodes/mirror-anu.debian.org.yaml
@@ -1,2 +1,5 @@
 classes:
   - roles::static_mirror_web
+
+roles::static_mirror_web::vhost_listen: '150.203.164.62:80 [2001:388:1034:2900::3e]:80'
+roles::static_mirror_web::vhost_listen_443: '150.203.164.62:443 [2001:388:1034:2900::3e]:443'

diff --git a/hieradata/nodes/mirror-isc.debian.org.yaml b/hieradata/nodes/mirror-isc.debian.org.yaml
index 08a059b..dbc6b4e 100644 (file)
--- a/hieradata/nodes/mirror-isc.debian.org.yaml
+++ b/hieradata/nodes/mirror-isc.debian.org.yaml
@@ -6,3 +6,8 @@ classes:
 roles::ports_mirror::vhost_listen: '149.20.4.15:80 [2001:4f8:1:c::15]:80'
 roles::ports_mirror::onion_service: true
 roles::ports_mirror::onion_addr: '149.20.4.15'
+
+roles::static_mirror_web::vhost_listen: '149.20.4.15:80 [2001:4f8:1:c::15]:80'
+roles::static_mirror_web::vhost_listen_443: '149.20.4.15:443 [2001:4f8:1:c::15]:443'
+roles::static_mirror_web::onion_service: true
+roles::static_mirror_web::onion_addr: '149.20.4.15'

diff --git a/hieradata/nodes/senfter.debian.org.yaml b/hieradata/nodes/senfter.debian.org.yaml
index 1a18dd4..3b25436 100644 (file)
--- a/hieradata/nodes/senfter.debian.org.yaml
+++ b/hieradata/nodes/senfter.debian.org.yaml
@@ -1,2 +1,5 @@
 classes:
   - roles::static_mirror_web
+
+roles::static_mirror_web::onion_service: true
+roles::static_mirror_web::onion_addr: '5.153.231.4'

diff --git a/modules/roles/manifests/static_mirror_web.pp b/modules/roles/manifests/static_mirror_web.pp
index 87e0f31..7895a59 100644 (file)
--- a/modules/roles/manifests/static_mirror_web.pp
+++ b/modules/roles/manifests/static_mirror_web.pp
@@ -1,5 +1,10 @@
 # a static web mirror
-class roles::static_mirror_web {
+class roles::static_mirror_web(
+  String  $vhost_listen = '*:80',
+  String  $vhost_listen_443 = '*:443',
+  Boolean $onion_service = false,
+  Optional[Stdlib::IP::Address] $onion_addr = undef,
+) {
   include roles::static_mirror
   include roles::weblog_provider
 
@@ -15,24 +20,6 @@ class roles::static_mirror_web {
   apache2::module { 'deflate': }
   apache2::module { 'filter': }
 
-  $onion_v4_addr = $::hostname ? {
-    klecker    => '130.89.148.14',
-    mirror-isc => '149.20.4.15',
-    senfter    => '5.153.231.4',
-    default    => undef,
-  }
-  $vhost_listen = $::hostname ? {
-    klecker    => '130.89.148.14:80 [2001:67c:2564:a119::148:14]:80',
-    mirror-isc => '149.20.4.15:80 [2001:4f8:1:c::15]:80',
-    mirror-anu => '150.203.164.62:80 [2001:388:1034:2900::3e]:80',
-    default    => '*:80',
-  }
-  $vhost_listen_443 = $::hostname ? {
-    klecker    => '130.89.148.14:443 [2001:67c:2564:a119::148:14]:443',
-    mirror-isc => '149.20.4.15:443 [2001:4f8:1:c::15]:443',
-    mirror-anu => '150.203.164.62:443 [2001:388:1034:2900::3e]:443',
-    default    => '*:443',
-  }
   $redirect_vhosts = true
 
   apache2::config { 'local-static-vhost.conf':
@@ -146,62 +133,62 @@ class roles::static_mirror_web {
   ssl::service { 'www.debconf.org'               : ensure => 'ifstatic', notify  => Exec['service apache2 reload'], key => true, }
 
 
-  if has_role('static_mirror_onion') {
-    if ! $onion_v4_addr {
-      fail("Do not have an onion_v4_addr set for $::hostname.")
+  if $onion_service {
+    if ! $onion_addr {
+      fail("Do not have an onion_addr set for $::hostname.")
     }
 
-    onion::service { 'd-i.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'dpl.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'dsa.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'rtc.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'www.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
+    onion::service { 'd-i.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'dpl.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'dsa.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'rtc.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'www.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
 
     # do
-    onion::service { 'appstream.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'backports.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'bits.debian.org'               : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'blends.debian.org'             : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'cdbuilder-logs.debian.org'     : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'incoming.debian.org'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'incoming.ports.debian.org'     : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'lintian.debian.org'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'manpages.debian.org'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'mirror-master.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'onion.debian.org'              : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'openpgpkey.debian.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'release.debian.org'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'security-team.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'www.ports.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
+    onion::service { 'appstream.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'backports.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'bits.debian.org'               : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'blends.debian.org'             : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'cdbuilder-logs.debian.org'     : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'incoming.debian.org'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'incoming.ports.debian.org'     : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'lintian.debian.org'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'manpages.debian.org'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'mirror-master.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'onion.debian.org'              : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'openpgpkey.debian.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'release.debian.org'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'security-team.debian.org'      : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'www.ports.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
     # dn
-    onion::service { 'bootstrap.debian.net'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debaday.debian.net'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debdeltas.debian.net'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'micronews.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'mozilla.debian.net'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'news.debian.net'               : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'timeline.debian.net'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'wnpp-by-tags.debian.net'       : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
+    onion::service { 'bootstrap.debian.net'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debaday.debian.net'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debdeltas.debian.net'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'micronews.debian.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'mozilla.debian.net'            : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'news.debian.net'               : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'timeline.debian.net'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'wnpp-by-tags.debian.net'       : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
     # dc
-    onion::service { '10years.debconf.org'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf0.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf1.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf16.debconf.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf17.debconf.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf18.debconf.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf2.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf3.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf4.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf5.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf6.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'debconf7.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'es.debconf.org'                : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'fr.debconf.org'                : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'miniconf10.debconf.org'        : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
+    onion::service { '10years.debconf.org'           : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf0.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf1.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf16.debconf.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf17.debconf.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf18.debconf.org'         : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf2.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf3.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf4.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf5.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf6.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'debconf7.debconf.org'          : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'es.debconf.org'                : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'fr.debconf.org'                : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'miniconf10.debconf.org'        : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
 
     # non-SSL
-    onion::service { 'metadata.ftp-master.debian.org': ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
-    onion::service { 'planet.debian.org'             : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr }
+    onion::service { 'metadata.ftp-master.debian.org': ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
+    onion::service { 'planet.debian.org'             : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr }
   }
 
   file { '/srv/static.debian.org/puppet':