modules/roles/manifests/snapshot_web.pp

   1 class roles::snapshot_web {
   2         include apache2
   3         include apache2::rewrite
   4
   5         # snapshot abusers
   6         #  61.69.254.110 - 20180705, mirroring with wget
   7         @ferm::rule { 'dsa-nat-snapshot-varnish-v4':
   8                 prio  => "000",
   9                 rule  => "saddr (61.69.254.110) DROP",
  10         }
  11
  12         ensure_packages ( [
  13                 "libapache2-mod-wsgi",
  14                 ], {
  15                 ensure => 'installed',
  16         })
  17
  18         apache2::site { '020-snapshot.debian.org':
  19                 site   => 'snapshot.debian.org',
  20                 content => template('roles/snapshot/snapshot.debian.org.conf.erb')
  21         }
  22
  23         case $::hostname {
  24                 'lw07': {
  25                         $ipv4addr        = '185.17.185.185'
  26                         $ipv6addr        = '2001:1af8:4020:b030:deb::185'
  27                         $ipv6addr_apache = '2001:1af8:4020:b030:deb::187'
  28                 }
  29                 'sallinen': {
  30                         $ipv4addr        = '193.62.202.27'
  31                         $ipv6addr        = '2001:630:206:4000:1a1a:0:c13e:ca1b'
  32                         $ipv6addr_apache = '2001:630:206:4000:1a1a:0:c13e:ca1a'
  33                 }
  34                 default: {
  35                         fail ( "unknown host $::hostname for snapshot_web." )
  36                 }
  37         }
  38
  39         # varnish cache
  40         ###############
  41         @ferm::rule { 'dsa-nat-snapshot-varnish-v4':
  42                 table => 'nat',
  43                 chain => 'PREROUTING',
  44                 rule  => "proto tcp daddr ${ipv4addr} dport 80 REDIRECT to-ports 6081",
  45         }
  46
  47         varnish::config { 'default':
  48                 listen  => [
  49                         ':6081',
  50                         "[$ipv6addr]:80"
  51                         ],
  52                 backend => 'file,/var/lib/varnish/varnish_storage.bin,8G',
  53                 content => template('roles/snapshot/snapshot.debian.org.vcl.erb'),
  54         }
  55
  56         # the ipv6 port 80 is owned by varnish
  57         file { '/etc/apache2/ports.conf':
  58                 content  => @("EOF"),
  59                         Listen 0.0.0.0:80
  60                         Listen [$ipv6addr_apache]:80
  61                         | EOF
  62                 require => Package['apache2'],
  63                 notify  => Service['apache2'],
  64         }
  65
  66         # haproxy ssl termination
  67         #########################
  68         include haproxy
  69         file { '/etc/haproxy/haproxy.cfg':
  70                 content => template('roles/snapshot/haproxy.cfg.erb'),
  71                 require => Package['haproxy'],
  72                 notify  => Service['haproxy'],
  73         }
  74         ssl::service { 'snapshot.debian.org':
  75                 notify  => Service['haproxy'],
  76                 key => true,
  77         }
  78 }