From: Peter Palfrader <peter@palfrader.org>
Date: Mon, 28 May 2018 09:19:34 +0000 (+0200)
Subject: And setup ferm
X-Git-Url: https://git.adam-barratt.org.uk/?a=commitdiff_plain;h=c5eb42423acaf8d52b565cbcaec8fe0b34deb67f;p=mirror%2Fdsa-puppet.git

And setup ferm
---

diff --git a/modules/roles/manifests/snapshot_web.pp b/modules/roles/manifests/snapshot_web.pp
index 76ce50364..e1f905930 100644
--- a/modules/roles/manifests/snapshot_web.pp
+++ b/modules/roles/manifests/snapshot_web.pp
@@ -15,26 +15,39 @@ class roles::snapshot_web {
 
 	case $::hostname {
 		'sallinen': {
-			varnish::config { 'default':
-				listen  => [
-					':6081',
-					'[2001:630:206:4000:1a1a:0:c13e:ca1b]:80'
-					],
-				backend => 'file,/var/lib/varnish/varnish_storage.bin,8G',
-				content => template('roles/snapshot/snapshot.debian.org.vcl.erb'),
-			}
-
-			file { '/etc/apache2/ports.conf':
-				content  => @("EOF"),
-					Listen 0.0.0.0:80
-					Listen [2001:630:206:4000:1a1a:0:c13e:ca1a]:80
-					| EOF
-				require => Package['apache2'],
-				notify  => Service['apache2'],
-			}
+			$ipv4addr        = '193.62.202.27'
+			$ipv6addr        = '2001:630:206:4000:1a1a:0:c13e:ca1b'
+			$ipv6addr_apache = '2001:630:206:4000:1a1a:0:c13e:ca1a'
 		}
 		default: {
 			fail ( "unknown host $::hostname for snapshot_web." )
 		}
 	}
+
+	@ferm::rule { 'dsa-snapshot-varnish-v4':
+		rule  => '&SERVICE(tcp, 6081)',
+	}
+	@ferm::rule { 'dsa-nat-snapshot-varnish-v4':
+		table => 'nat',
+		chain => 'PREROUTING',
+		rule  => 'proto tcp daddr $ipv4addr dport 80 REDIRECT to-ports 6081',
+	}
+
+	varnish::config { 'default':
+		listen  => [
+			':6081',
+			"[$ipv6addr]:80"
+			],
+		backend => 'file,/var/lib/varnish/varnish_storage.bin,8G',
+		content => template('roles/snapshot/snapshot.debian.org.vcl.erb'),
+	}
+
+	file { '/etc/apache2/ports.conf':
+		content  => @("EOF"),
+			Listen 0.0.0.0:80
+			Listen [$ipv6addr_apache]:80
+			| EOF
+		require => Package['apache2'],
+		notify  => Service['apache2'],
+	}
 }