Mercurial > repos > other > Puppet

comparison manifests/templates.pp @ 279:e36b7f4f85f2

Find changesets by keywords (author, files, the commit message), revision number or hash, or revset expression.
Start to support IPv6 servers * Assumed only one or the other, not dual stack * Removed old VPS setup * Removed "secondary IP", added IPv4-to-6 forwarding * Updated firewall rules * Moved HTTP firewall rules to website module so it can do the right thing based on IP address families
author IBBoard <dev@ibboard.co.uk>
date Sat, 15 Feb 2020 13:52:30 +0000
parents 165ad12ea8ca
children af7df930a670
comparison
equal deleted inserted replaced
278:a8bf3a400712 279:e36b7f4f85f2
25 } 25 }
26 } 26 }
27 27
28 class basevpsnode ( 28 class basevpsnode (
29 $primary_ip, 29 $primary_ip,
30 $secondary_ip, 30 $proxy_6to4_ip = undef,
31 $proxy_upstream = undef,
31 $mailserver, 32 $mailserver,
32 $imapserver, 33 $imapserver,
33 $firewall_cmd = 'iptables', 34 $firewall_cmd = 'iptables',
34 ) { 35 ) {
35 36
36 if $firewall_cmd == 'iptables' { 37 if $firewall_cmd == 'iptables' {
37 include vpsfirewall 38 class { 'vpsfirewall':
39 fw_protocol => $primary_ip =~ Stdlib::IP::Address::V6 ? { true => 'IPv6', default => 'IPv4'},
40 }
38 } 41 }
39 42
40 #VPS is a self-mastered Puppet machine, so bodge a Hosts file 43 #VPS is a self-mastered Puppet machine, so bodge a Hosts file
41 file { '/etc/hosts': 44 file { '/etc/hosts':
42 ensure => present, 45 ensure => present,
51 include ssh::server 54 include ssh::server
52 include vcs::server 55 include vcs::server
53 include vcs::client 56 include vcs::client
54 class { 'webserver': 57 class { 'webserver':
55 primary_ip => $primary_ip, 58 primary_ip => $primary_ip,
56 secondary_ip => $secondary_ip, 59 proxy_6to4_ip => $proxy_6to4_ip,
60 proxy_upstream => $proxy_upstream,
57 } 61 }
58 include cronjobs 62 include cronjobs
59 include logrotate 63 include logrotate
60 class { 'fail2ban': 64 class { 'fail2ban':
61 firewall_cmd => $firewall_cmd, 65 firewall_cmd => $firewall_cmd,
67 } 71 }
68 } 72 }
69 73
70 ## Classes to allow facet behaviour using preconfigured setups of classes 74 ## Classes to allow facet behaviour using preconfigured setups of classes
71 75
72 class vpsfirewall { 76 class vpsfirewall ($fw_protocol) {
73 resources { "firewall": 77 resources { "firewall":
74 purge => false, 78 purge => false,
75 } 79 }
76 firewallchain { 'INPUT:filter:IPv4': 80 class { "my_fw":
77 purge => true, 81 ip_version => $fw_protocol,
82 }
83 # Control what does and doesn't get pruned in the main filter chain
84 firewallchain { "INPUT:filter:$fw_protocol":
85 purge => true,
78 ignore => [ 86 ignore => [
79 '-j f2b-[^ ]+$', 87 '-j f2b-[^ ]+$',
80 '^(:|-A )f2b-', 88 '^(:|-A )f2b-',
81 '--comment "Great Firewall of China"', 89 '--comment "Great Firewall of China"',
82 '--comment "Do not purge', 90 '--comment "Do not purge',
83 ], 91 ],
84 } 92 }
85 Firewall { 93 if ($fw_protocol != "IPv6") {
86 before => Class['my_fw::post'], 94 firewall { '010 Whitelist Googlebot':
87 require => Class['my_fw::pre'], 95 source => '66.249.64.0/19',
88 } 96 dport => [80,443],
89 class { ['my_fw::pre', 'my_fw::post']: } 97 proto => tcp,
90 class { 'firewall': } 98 action => accept,
91 firewall { '010 Whitelist Googlebot': 99 }
92 source => '66.249.64.0/19', 100 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT)
93 dport => [80,443], 101 firewall { '099 Blacklist spammers 1':
94 proto => tcp, 102 source => '107.181.78.172',
95 action => accept, 103 dport => [80, 443],
96 } 104 proto => tcp,
97 # Block a spammer hitting our contact forms (also on StopForumSpam list A LOT) 105 action => 'reject',
98 firewall { '099 Blacklist spammers 1': 106 }
99 source => '107.181.78.172', 107 firewall { '099 Blacklist IODC bot':
100 dport => [80, 443], 108 # IODC bot makes too many bad requests, and contact form is broken
101 proto => tcp, 109 # They don't publish a robots.txt name, so firewall it!
102 action => 'reject', 110 source => '86.153.145.149',
103 } 111 dport => [ 80, 443 ],
104 firewall { '099 Blacklist IODC bot': 112 proto => tcp,
105 # IODC bot makes too many bad requests, and contact form is broken 113 action => 'reject',
106 # They don't publish a robots.txt name, so firewall it! 114 }
107 source => '86.153.145.149', 115 firewall { '099 Blacklist Baidu Brazil':
108 dport => [ 80, 443 ], 116 #Baidu got a Brazilian netblock and are hitting us hard
109 proto => tcp, 117 #Baidu doesn't honour "crawl-delay" in robots.txt
110 action => 'reject', 118 #Baidu gets firewalled
111 } 119 source => '131.161.8.0/22',
112 firewall { '099 Blacklist Baidu Brazil': 120 dport => [ 80, 443 ],
113 #Baidu got a Brazilian netblock and are hitting us hard 121 proto => tcp,
114 #Baidu doesn't honour "crawl-delay" in robots.txt 122 action => 'reject',
115 #Baidu gets firewalled 123 }
116 source => '131.161.8.0/22', 124 }
117 dport => [ 80, 443 ], 125 firewallchain { "GREATFIREWALLOFCHINA:filter:$fw_protocol":
118 proto => tcp,
119 action => 'reject',
120 }
121 firewallchain { 'GREATFIREWALLOFCHINA:filter:IPv4':
122 ensure => present, 126 ensure => present,
123 } 127 }
124 firewall { '050 Check our Great Firewall Against China': 128 firewall { '050 Check our Great Firewall Against China':
125 chain => 'INPUT', 129 chain => 'INPUT',
126 jump => 'GREATFIREWALLOFCHINA', 130 jump => 'GREATFIREWALLOFCHINA',
127 } 131 }
128 firewallchain { 'Fail2Ban:filter:IPv4': 132 firewallchain { "Fail2Ban:filter:$fw_protocol":
129 ensure => present, 133 ensure => present,
130 } 134 }
131 firewall { '060 Check Fail2Ban': 135 firewall { '060 Check Fail2Ban':
132 chain => 'INPUT', 136 chain => 'INPUT',
133 jump => 'Fail2Ban', 137 jump => 'Fail2Ban',
134 }
135 firewall { '100 allow https and http':
136 dport => [80, 443],
137 proto => tcp,
138 action => accept,
139 } 138 }
140 firewall { '101 allow SMTP': 139 firewall { '101 allow SMTP':
141 dport => [25, 465], 140 dport => [25, 465],
142 proto => tcp, 141 proto => tcp,
143 action => accept, 142 action => accept,
409 } 408 }
410 409
411 #Our web server with our configs, not just a stock one 410 #Our web server with our configs, not just a stock one
412 class webserver ( 411 class webserver (
413 $primary_ip, 412 $primary_ip,
414 $secondary_ip, 413 $proxy_6to4_ip = undef,
414 $proxy_upstream = undef,
415 ) { 415 ) {
416 #Setup base website parameters 416 #Setup base website parameters
417 class { 'website': 417 class { 'website':
418 base_dir => '/srv/sites', 418 base_dir => '/srv/sites',
419 primary_ip => $primary_ip, 419 primary_ip => $primary_ip,
420 secondary_ip => $secondary_ip, 420 proxy_6to4_ip => $proxy_6to4_ip,
421 proxy_upstream => $proxy_upstream,
421 default_owner => $defaultusers::default_user, 422 default_owner => $defaultusers::default_user,
422 default_group => $defaultusers::default_user, 423 default_group => $defaultusers::default_user,
423 default_tld => 'co.uk', 424 default_tld => 'co.uk',
424 default_extra_tlds => [ 'com' ], 425 default_extra_tlds => [ 'com' ],
425 } 426 }
514 } 515 }
515 } 516 }
516 517
517 class ibboardvpsnode ( 518 class ibboardvpsnode (
518 $primary_ip, 519 $primary_ip,
519 $secondary_ip = $primary_ip, 520 $proxy_6to4_ip = undef,
521 $proxy_upstream = undef,
520 $mailserver, 522 $mailserver,
521 $imapserver, 523 $imapserver,
522 $firewall_cmd = 'iptables', 524 $firewall_cmd = 'iptables',
523 ){ 525 ){
524 class { 'basevpsnode': 526 class { 'basevpsnode':
525 primary_ip => $primary_ip, 527 primary_ip => $primary_ip,
526 secondary_ip => $secondary_ip, 528 proxy_6to4_ip => $proxy_6to4_ip,
529 proxy_upstream => $proxy_upstream,
527 mailserver => $mailserver, 530 mailserver => $mailserver,
528 imapserver => $imapserver, 531 imapserver => $imapserver,
529 firewall_cmd => $firewall_cmd, 532 firewall_cmd => $firewall_cmd,
530 } 533 }
531 534