separate refidp to separate vm

global/overlay/etc/puppet/cosmos-rules.yaml

@@ -468,6 +468,20 @@ md-eu1.qa.komreg.net:
    eidas_sp:
       version: 1.0.0
       hostname: qa.test.swedenconnect.se
+   sunet::frontend::register_sites:
+     sites:
+       'qa.test.swedenconnect.se':
+         frontends:
+           - 'se-fre-lb-1.sunet.se'
+           - 'se-tug-lb-1.sunet.se'
+         port: '443'
+
+'^refidp-[0-9]+\.qa\.sveidas\.se$':
+   sunet_iaas_cloud:
+   eid::dockerhost:
+   konsulter:
+   autoupdate:
+   servicemonitor:
    swedenconnect_refidp:
       version: 1.0.3
       hostname: qa.test.swedenconnect.se

global/overlay/etc/puppet/manifests/cosmos-site.pp

@@ -283,7 +283,7 @@ class swedenconnect_refidp($version="1.0.3",$hostname='localhost') {
       image    => 'docker.sunet.se/swedenconnect-idp',
       imagetag => $_version,
       hostname => "${::fqdn}",
-      ports    => ['8443:8443'],
+      ports    => ['443:8443'],
       volumes  => ['/var/log/swedenconnect-idp:/var/log/swedenconnect-idp',
                    '/etc/swedenconnect-idp:/etc/swedenconnect-idp',
                    '/dev/log:/dev/log',
@@ -294,10 +294,8 @@ class swedenconnect_refidp($version="1.0.3",$hostname='localhost') {
                    "IDP_PERSISTENT_ID_SALT=$idp_persistent_id_salt",
                    "IDP_FTICKS_SALT=$idp_fticks_salt"]
    }
-   ufw::allow { "allow-alt-https":
+   ensure_resource('class','webserver',{})
-      ip   => 'any',
+   ensure_resource('class','https_server',{}) 
-      port => '8443'
-   }
 }
 
 class eidas_connector($version="1.0.6",$hostname='localhost') {