swedenconnect/eid-ops
0
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

added prid ufw rules

Browse source
This commit is contained in:
Erik Bergström 2018-06-18 11:59:07 +02:00
parent 4b30c58d2e
commit dd214d88f3
2 changed files with 8 additions and 2 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

2
global/overlay/etc/puppet/cosmos-rules.yaml
View file

@ -244,6 +244,7 @@ md-eu1.qa.komreg.net:
servicemonitor: servicemonitor:
prid: prid:
version: 1.0.1 version: 1.0.1
clients: 'prid_prod_clients'
'^eidas-proxy-[0-9]+\.sveidas\.se$': '^eidas-proxy-[0-9]+\.sveidas\.se$':
eid::dockerhost: eid::dockerhost:
@ -313,6 +314,7 @@ md-eu1.qa.komreg.net:
servicemonitor: servicemonitor:
prid: prid:
version: 1.0.1 version: 1.0.1
clients: 'prid_qa_clients'
'^validator-[0-9]+\.qa\.komreg\.net$': '^validator-[0-9]+\.qa\.komreg\.net$':
openstack_dockerhost: openstack_dockerhost:

8
global/overlay/etc/puppet/manifests/cosmos-site.pp
View file

@ -291,9 +291,10 @@ class eidas_proxy($version='1.0.0',$country='se',$hostname='localhost') {
class {'https_server': } class {'https_server': }
} }
class prid($version="1.0.0") { class prid($version="1.0.0",$clients) {
$_version = safe_hiera('eidas_prid_version',$version) $_version = safe_hiera('eidas_prid_version',$version)
$hostname = $::fqdn $hostname = $::fqdn
$_allow_clients = safe_hiera($clients)
sunet::docker_run {'prid': sunet::docker_run {'prid':
image => 'docker.sunet.se/prid-service', image => 'docker.sunet.se/prid-service',
imagetag => $_version, imagetag => $_version,
@ -304,7 +305,10 @@ class prid($version="1.0.0") {
env => ["PRID_SERVICE_POLICY_CONFIGURATION=file:///etc/prid-service/policy.properties", env => ["PRID_SERVICE_POLICY_CONFIGURATION=file:///etc/prid-service/policy.properties",
"CERTNAME=${hostname}_infra"] "CERTNAME=${hostname}_infra"]
} -> } ->
class {'webserver': } -> sunet::misc::ufw_allow {'allow-prid':
from => $_allow_clients,
port => 443
} ->
class {'https_server': } class {'https_server': }
} }