From dac9147701f927033b5fa0f59d1a07859d9eddda Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sun, 15 Sep 2019 20:38:26 +0200 Subject: [PATCH] Retire static_mirror_onion and move IP address lists out of static_mirror_web and into hiera --- hieradata/common.yaml | 4 - hieradata/nodes/klecker.debian.org.yaml | 5 + hieradata/nodes/mirror-anu.debian.org.yaml | 3 + hieradata/nodes/mirror-isc.debian.org.yaml | 5 + hieradata/nodes/senfter.debian.org.yaml | 3 + modules/roles/manifests/static_mirror_web.pp | 121 +++++++++---------- 6 files changed, 70 insertions(+), 71 deletions(-) diff --git a/hieradata/common.yaml b/hieradata/common.yaml index b24dc1b2b..9cecbc9b9 100644 --- a/hieradata/common.yaml +++ b/hieradata/common.yaml @@ -99,10 +99,6 @@ roles: wieck.debian.org: service-hostname: wieck.security.backend.mirrors.debian.org fastly-backend: true - static_mirror_onion: - - klecker.debian.org - - mirror-isc.debian.org - - senfter.debian.org syncproxy: - gretchaninov.debian.org - klecker.debian.org diff --git a/hieradata/nodes/klecker.debian.org.yaml b/hieradata/nodes/klecker.debian.org.yaml index 4ac182c67..57f87f310 100644 --- a/hieradata/nodes/klecker.debian.org.yaml +++ b/hieradata/nodes/klecker.debian.org.yaml @@ -6,3 +6,8 @@ classes: roles::ports_mirror::vhost_listen: '130.89.148.14:80 [2001:67c:2564:a119::148:14]:80' roles::ports_mirror::onion_service: true roles::ports_mirror::onion_addr: '130.89.148.14' + +roles::static_mirror_web::vhost_listen: '130.89.148.14:80 [2001:67c:2564:a119::148:14]:80' +roles::static_mirror_web::vhost_listen_443: '130.89.148.14:443 [2001:67c:2564:a119::148:14]:443' +roles::static_mirror_web::onion_service: true +roles::static_mirror_web::onion_addr: '130.89.148.14' diff --git a/hieradata/nodes/mirror-anu.debian.org.yaml b/hieradata/nodes/mirror-anu.debian.org.yaml index 1a18dd42a..80eda9af6 100644 --- a/hieradata/nodes/mirror-anu.debian.org.yaml +++ b/hieradata/nodes/mirror-anu.debian.org.yaml @@ -1,2 +1,5 @@ classes: - roles::static_mirror_web + +roles::static_mirror_web::vhost_listen: '150.203.164.62:80 [2001:388:1034:2900::3e]:80' +roles::static_mirror_web::vhost_listen_443: '150.203.164.62:443 [2001:388:1034:2900::3e]:443' diff --git a/hieradata/nodes/mirror-isc.debian.org.yaml b/hieradata/nodes/mirror-isc.debian.org.yaml index 08a059b47..dbc6b4ed1 100644 --- a/hieradata/nodes/mirror-isc.debian.org.yaml +++ b/hieradata/nodes/mirror-isc.debian.org.yaml @@ -6,3 +6,8 @@ classes: roles::ports_mirror::vhost_listen: '149.20.4.15:80 [2001:4f8:1:c::15]:80' roles::ports_mirror::onion_service: true roles::ports_mirror::onion_addr: '149.20.4.15' + +roles::static_mirror_web::vhost_listen: '149.20.4.15:80 [2001:4f8:1:c::15]:80' +roles::static_mirror_web::vhost_listen_443: '149.20.4.15:443 [2001:4f8:1:c::15]:443' +roles::static_mirror_web::onion_service: true +roles::static_mirror_web::onion_addr: '149.20.4.15' diff --git a/hieradata/nodes/senfter.debian.org.yaml b/hieradata/nodes/senfter.debian.org.yaml index 1a18dd42a..3b2543615 100644 --- a/hieradata/nodes/senfter.debian.org.yaml +++ b/hieradata/nodes/senfter.debian.org.yaml @@ -1,2 +1,5 @@ classes: - roles::static_mirror_web + +roles::static_mirror_web::onion_service: true +roles::static_mirror_web::onion_addr: '5.153.231.4' diff --git a/modules/roles/manifests/static_mirror_web.pp b/modules/roles/manifests/static_mirror_web.pp index 87e0f31ca..7895a59d2 100644 --- a/modules/roles/manifests/static_mirror_web.pp +++ b/modules/roles/manifests/static_mirror_web.pp @@ -1,5 +1,10 @@ # a static web mirror -class roles::static_mirror_web { +class roles::static_mirror_web( + String $vhost_listen = '*:80', + String $vhost_listen_443 = '*:443', + Boolean $onion_service = false, + Optional[Stdlib::IP::Address] $onion_addr = undef, +) { include roles::static_mirror include roles::weblog_provider @@ -15,24 +20,6 @@ class roles::static_mirror_web { apache2::module { 'deflate': } apache2::module { 'filter': } - $onion_v4_addr = $::hostname ? { - klecker => '130.89.148.14', - mirror-isc => '149.20.4.15', - senfter => '5.153.231.4', - default => undef, - } - $vhost_listen = $::hostname ? { - klecker => '130.89.148.14:80 [2001:67c:2564:a119::148:14]:80', - mirror-isc => '149.20.4.15:80 [2001:4f8:1:c::15]:80', - mirror-anu => '150.203.164.62:80 [2001:388:1034:2900::3e]:80', - default => '*:80', - } - $vhost_listen_443 = $::hostname ? { - klecker => '130.89.148.14:443 [2001:67c:2564:a119::148:14]:443', - mirror-isc => '149.20.4.15:443 [2001:4f8:1:c::15]:443', - mirror-anu => '150.203.164.62:443 [2001:388:1034:2900::3e]:443', - default => '*:443', - } $redirect_vhosts = true apache2::config { 'local-static-vhost.conf': @@ -146,62 +133,62 @@ class roles::static_mirror_web { ssl::service { 'www.debconf.org' : ensure => 'ifstatic', notify => Exec['service apache2 reload'], key => true, } - if has_role('static_mirror_onion') { - if ! $onion_v4_addr { - fail("Do not have an onion_v4_addr set for $::hostname.") + if $onion_service { + if ! $onion_addr { + fail("Do not have an onion_addr set for $::hostname.") } - onion::service { 'd-i.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'dpl.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'dsa.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'rtc.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'www.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } + onion::service { 'd-i.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'dpl.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'dsa.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'rtc.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'www.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } # do - onion::service { 'appstream.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'backports.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'bits.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'blends.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'cdbuilder-logs.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'incoming.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'incoming.ports.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'lintian.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'manpages.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'mirror-master.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'onion.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'openpgpkey.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'release.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'security-team.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'www.ports.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } + onion::service { 'appstream.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'backports.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'bits.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'blends.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'cdbuilder-logs.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'incoming.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'incoming.ports.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'lintian.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'manpages.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'mirror-master.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'onion.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'openpgpkey.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'release.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'security-team.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'www.ports.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } # dn - onion::service { 'bootstrap.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debaday.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debdeltas.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'micronews.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'mozilla.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'news.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'timeline.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'wnpp-by-tags.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } + onion::service { 'bootstrap.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debaday.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debdeltas.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'micronews.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'mozilla.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'news.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'timeline.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'wnpp-by-tags.debian.net' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } # dc - onion::service { '10years.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf0.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf1.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf16.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf17.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf18.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf2.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf3.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf4.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf5.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf6.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'debconf7.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'es.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'fr.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'miniconf10.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } + onion::service { '10years.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf0.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf1.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf16.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf17.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf18.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf2.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf3.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf4.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf5.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf6.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'debconf7.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'es.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'fr.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'miniconf10.debconf.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } # non-SSL - onion::service { 'metadata.ftp-master.debian.org': ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } - onion::service { 'planet.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_v4_addr } + onion::service { 'metadata.ftp-master.debian.org': ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } + onion::service { 'planet.debian.org' : ensure => 'ifstatic', port => 80, target_port => 80, target_address => $onion_addr } } file { '/srv/static.debian.org/puppet': -- 2.20.1