From d25a2c76158604d7f45e732f3655082376231811 Mon Sep 17 00:00:00 2001 From: Peter Palfrader Date: Sun, 22 Sep 2019 17:07:38 +0200 Subject: [PATCH] debian_mirror -> hiera role --- data/common.yaml | 24 ---------- data/nodes/mirror-accumu.debian.org.yaml | 3 ++ data/nodes/mirror-isc.debian.org.yaml | 4 ++ data/nodes/mirror-skroutz.debian.org.yaml | 6 +++ data/nodes/new-klecker.debian.org.yaml | 3 ++ data/nodes/schmelzer.debian.org.yaml | 3 ++ modules/roles/manifests/debian_mirror.pp | 58 +++++++++++++---------- modules/roles/manifests/init.pp | 5 -- 8 files changed, 51 insertions(+), 55 deletions(-) create mode 100644 data/nodes/mirror-skroutz.debian.org.yaml diff --git a/data/common.yaml b/data/common.yaml index 75251f406..37432d711 100644 --- a/data/common.yaml +++ b/data/common.yaml @@ -97,30 +97,6 @@ roles: # XXX - used by ferm templates/defs.conf.erb - backuphost.debian.org - storace.debian.org - debian_mirror: - # XXX used also in ferm me.conf.erb - new-klecker.debian.org: - listen-addresses: - - '130.89.148.12:80' - - '[2001:67c:2564:a119::148:12]:80' - onion_v4_address: 130.89.148.12 - mirror-accumu.debian.org: - service-hostname: accumu.debian.backend.mirrors.debian.org - fastly-backend: true - mirror-skroutz.debian.org: - service-hostname: skroutz.debian.backend.mirrors.debian.org - fastly-backend: true - mirror-isc.debian.org: - listen-addresses: - - '149.20.4.15:80' - - '[2001:4f8:1:c::15]:80' - onion_v4_address: 149.20.4.15 - schmelzer.debian.org: - listen-addresses: - - '217.196.149.232:80' - - '[2a02:16a8:dc41:100::232]:80' - fastly-backend: true - service-hostname: conova.debian.backend.mirrors.debian.org bgp: - mirror-accumu.debian.org - mirror-skroutz.debian.org diff --git a/data/nodes/mirror-accumu.debian.org.yaml b/data/nodes/mirror-accumu.debian.org.yaml index 92bf38ee7..1792854f9 100644 --- a/data/nodes/mirror-accumu.debian.org.yaml +++ b/data/nodes/mirror-accumu.debian.org.yaml @@ -1,6 +1,9 @@ --- classes: + - roles::debian_mirror - roles::debug_mirror +roles::debian_mirror::listen_addr: ['130.242.6.199', '2001:6b0:1e:2::1c7', '193.31.7.2', '2a02:158:ffff:deb::2'] +roles::debian_mirror::healthcheck_name: accumu.debian.backend.mirrors.debian.org roles::debug_mirror::onion_service: true roles::debug_mirror::healthcheck_name: accumu.debug.backend.mirrors.debian.org diff --git a/data/nodes/mirror-isc.debian.org.yaml b/data/nodes/mirror-isc.debian.org.yaml index fd21f64d4..2de09ca25 100644 --- a/data/nodes/mirror-isc.debian.org.yaml +++ b/data/nodes/mirror-isc.debian.org.yaml @@ -1,9 +1,13 @@ --- classes: + - roles::debian_mirror - roles::ports_mirror - roles::static_mirror_web - roles::syncproxy +roles::debian_mirror::listen_addr: ['149.20.4.15', '2001:4f8:1:c::15'] +roles::debian_mirror::onion_service: true + roles::ports_mirror::listen_addr: ['149.20.4.15', '2001:4f8:1:c::15'] roles::ports_mirror::onion_service: true diff --git a/data/nodes/mirror-skroutz.debian.org.yaml b/data/nodes/mirror-skroutz.debian.org.yaml new file mode 100644 index 000000000..a2ba7a9bd --- /dev/null +++ b/data/nodes/mirror-skroutz.debian.org.yaml @@ -0,0 +1,6 @@ +--- +classes: + - roles::debian_mirror + +roles::debian_mirror::listen_addr: ['154.57.0.251', '2a03:e40:42:200::151:3', '193.31.7.2', '2a02:158:ffff:deb::2'] +roles::debian_mirror::healthcheck_name: skroutz.debian.backend.mirrors.debian.org diff --git a/data/nodes/new-klecker.debian.org.yaml b/data/nodes/new-klecker.debian.org.yaml index cafa3c82b..17f8641f7 100644 --- a/data/nodes/new-klecker.debian.org.yaml +++ b/data/nodes/new-klecker.debian.org.yaml @@ -1,8 +1,11 @@ --- classes: + - roles::debian_mirror - roles::static_mirror_web - roles::ports_mirror +roles::debian_mirror::listen_addr: ['130.89.148.12', '2001:67c:2564:a119::148:12'] +roles::debian_mirror::onion_service: true roles::ports_mirror::onion_service: true roles::static_mirror_web::onion_service: true diff --git a/data/nodes/schmelzer.debian.org.yaml b/data/nodes/schmelzer.debian.org.yaml index dd405fd0f..4740e41e0 100644 --- a/data/nodes/schmelzer.debian.org.yaml +++ b/data/nodes/schmelzer.debian.org.yaml @@ -1,9 +1,12 @@ --- classes: + - roles::debian_mirror - roles::debug_mirror - roles::historical_mirror - roles::syncproxy +roles::debian_mirror::listen_addr: ['217.196.149.232', '2a02:16a8:dc41:100::232'] +roles::debian_mirror::healthcheck_name: conova.debian.backend.mirrors.debian.org roles::debug_mirror::listen_addr: ['217.196.149.232', '2a02:16a8:dc41:100::232'] roles::debug_mirror::onion_service: true roles::debug_mirror::healthcheck_name: conova.debug.backend.mirrors.debian.org diff --git a/modules/roles/manifests/debian_mirror.pp b/modules/roles/manifests/debian_mirror.pp index 7cf72547b..45f6480cc 100644 --- a/modules/roles/manifests/debian_mirror.pp +++ b/modules/roles/manifests/debian_mirror.pp @@ -1,45 +1,51 @@ -class roles::debian_mirror { +# an ftp.debian.org mirror/cdn backend +# +# @param listen_addr IP addresses to have apache listen on +# @param onion_service provide the onion service from this host +# @param healthcheck_name name to access this node in the health checker +class roles::debian_mirror( + Array[Stdlib::IP::Address] $listen_addr = [], + Boolean $onion_service = false, + Optional[String] $healthcheck_name = undef, +) { include roles::archvsync_base + include apache2 + + $_enclosed_addresses = empty($listen_addr) ? { + true => ['*'], + default => enclose_ipv6($listen_addr), + } + $vhost_listen = $_enclosed_addresses.map |$a| { "${a}:80" } .join(' ') $mirror_basedir_prefix = hiera('role_config__mirrors.mirror_basedir_prefix') $archive_root = "${mirror_basedir_prefix}debian" - $listen_addresses = hiera('roles.debian_mirror') - .dig($::fqdn, 'listen-addresses') - .then |$a| { $a } - .lest || { ['*:80'] } - - $vhost_listen = join([ - *$listen_addresses, - has_role('bgp') ? { - true => '193.31.7.2:80 [2a02:158:ffff:deb::2]:80', - default => '', - }], ' ') apache2::site { '010-ftp.debian.org': site => 'ftp.debian.org', content => template('roles/apache-ftp.debian.org.erb'), } - $onion_v4_addr = hiera('roles.debian_mirror', {}) - .dig($::fqdn, 'onion_v4_address') - if $onion_v4_addr { + if $onion_service { + $onion_addr = empty($listen_addr) ? { + true => $base::public_address, + default => filter_ipv4($listen_addr)[0] + } + if ! $onion_addr { + fail("Do not have a useable address for the onionservice on ${::hostname}. Is \$listen_addr empty or does it not have an IPv4 address?.") + } + onion::service { 'ftp.debian.org': port => 80, target_port => 80, - target_address => $onion_v4_addr, + target_address => $onion_addr, } } - $hosts_to_check = hiera('roles.debian_mirror', {}) - .filter |$h| { $h[1]['fastly-backend'] } - .map |$h| { $h[1]['service-hostname'] } + Ferm::Rule::Simple <<| tag == 'ssh::server::from::syncproxy' |>> - roles::mirror_health { 'ftp': - check_hosts => $hosts_to_check, - check_service => 'ftp', - url => 'http://debian.backend.mirrors.debian.org/debian/dists/sid/Release', - health_url => 'http://debian.backend.mirrors.debian.org/_health', + mirror_health::service { 'ftp': + this_host_service_name => $healthcheck_name, + url => 'http://debian.backend.mirrors.debian.org/debian/dists/sid/Release', + health_url => 'http://debian.backend.mirrors.debian.org/_health', } - - Ferm::Rule::Simple <<| tag == 'ssh::server::from::syncproxy' |>> } diff --git a/modules/roles/manifests/init.pp b/modules/roles/manifests/init.pp index eff82e77d..2324e5714 100644 --- a/modules/roles/manifests/init.pp +++ b/modules/roles/manifests/init.pp @@ -11,11 +11,6 @@ class roles { include nagios::server } - # ftp.debian.org and its ecosystem - if has_role('debian_mirror') { - include roles::debian_mirror - } - if has_role('security_mirror') { include roles::security_mirror } -- 2.20.1