fix rule name
[mirror/dsa-puppet.git] / modules / roles / manifests / snapshot_web.pp
1 class roles::snapshot_web {
2         include apache2
3         include apache2::rewrite
4
5         # snapshot abusers
6         #  61.69.254.110 - 20180705, mirroring with wget
7         @ferm::rule { 'dsa-snapshot-abusers':
8                 prio  => "000",
9                 rule  => "saddr (61.69.254.110) DROP",
10         }
11
12         ensure_packages ( [
13                 "libapache2-mod-wsgi",
14                 ], {
15                 ensure => 'installed',
16         })
17
18         apache2::site { '020-snapshot.debian.org':
19                 site   => 'snapshot.debian.org',
20                 content => template('roles/snapshot/snapshot.debian.org.conf.erb')
21         }
22
23         case $::hostname {
24                 'lw07': {
25                         $ipv4addr        = '185.17.185.185'
26                         $ipv6addr        = '2001:1af8:4020:b030:deb::185'
27                         $ipv6addr_apache = '2001:1af8:4020:b030:deb::187'
28                 }
29                 'sallinen': {
30                         $ipv4addr        = '193.62.202.27'
31                         $ipv6addr        = '2001:630:206:4000:1a1a:0:c13e:ca1b'
32                         $ipv6addr_apache = '2001:630:206:4000:1a1a:0:c13e:ca1a'
33                 }
34                 default: {
35                         fail ( "unknown host $::hostname for snapshot_web." )
36                 }
37         }
38
39         # varnish cache
40         ###############
41         @ferm::rule { 'dsa-nat-snapshot-varnish-v4':
42                 table => 'nat',
43                 chain => 'PREROUTING',
44                 rule  => "proto tcp daddr ${ipv4addr} dport 80 REDIRECT to-ports 6081",
45         }
46
47         varnish::config { 'default':
48                 listen  => [
49                         ':6081',
50                         "[$ipv6addr]:80"
51                         ],
52                 backend => 'file,/var/lib/varnish/varnish_storage.bin,8G',
53                 content => template('roles/snapshot/snapshot.debian.org.vcl.erb'),
54         }
55
56         # the ipv6 port 80 is owned by varnish
57         file { '/etc/apache2/ports.conf':
58                 content  => @("EOF"),
59                         Listen 0.0.0.0:80
60                         Listen [$ipv6addr_apache]:80
61                         | EOF
62                 require => Package['apache2'],
63                 notify  => Service['apache2'],
64         }
65
66         # haproxy ssl termination
67         #########################
68         include haproxy
69         file { '/etc/haproxy/haproxy.cfg':
70                 content => template('roles/snapshot/haproxy.cfg.erb'),
71                 require => Package['haproxy'],
72                 notify  => Service['haproxy'],
73         }
74         ssl::service { 'snapshot.debian.org':
75                 notify  => Service['haproxy'],
76                 key => true,
77         }
78 }