Use export/collect to get the intra-cluster firewall opened for pubsub

diff --git a/modules/roles/manifests/pubsub.pp b/modules/roles/manifests/pubsub.pp
index 4600665..1312a4b 100644 (file)
--- a/modules/roles/manifests/pubsub.pp
+++ b/modules/roles/manifests/pubsub.pp
@@ -35,15 +35,9 @@ class roles::pubsub {
     rule        => '&SERVICE_RANGE(tcp, 5671, $HOST_DEBIAN)'
   }
 
-  if $::hostname == $cc_master {
-    $other = join(getfromhash($deprecated::allnodeinfo, "${cc_secondary}.debian.org", 'ipHostNumber'), ' ')
-  } else {
-    $other = join(getfromhash($deprecated::allnodeinfo, "${cc_master}.debian.org", 'ipHostNumber'), ' ')
-  }
-
-  ferm::rule { 'rabbitmq_cluster':
-    domain      => '(ip ip6)',
-    description => 'rabbitmq cluster connections',
-    rule        => "proto tcp mod state state (NEW) saddr (${other}) ACCEPT"
+  @@ferm::rule::simple { "pubsub-cluster-from-${::fqdn}":
+    tag   => 'roles::pubsub::intra-cluster',
+    saddr => $base::public_addresses,
   }
+  Ferm::Rule::Simple <<| tag == 'roles::pubsub::intra-cluster' |>>
 }