}
end
- search(:node, "roles:shenron OR roles:prometheus") do |server|
+ search(:node, "roles:prometheus") do |server|
allowed_ips = server.interfaces(:role => :internal).map do |interface|
"#{interface[:network]}/#{interface[:prefix]}"
end
to "../run/systemd/resolve/stub-resolv.conf"
end
+hosts = { "inet" => [], "inet6" => [] }
zones = {}
search(:node, "networking:interfaces").collect do |n|
n.interfaces.each do |interface|
next unless interface[:role] == "external" && interface[:zone]
+ hosts[interface[:family]] << interface[:address]
+
zones[interface[:zone]] ||= {}
zones[interface[:zone]][interface[:family]] ||= []
zones[interface[:zone]][interface[:family]] << interface[:address]
end
end
-package "shorewall"
-
-systemd_service "shorewall-docker" do
- service "shorewall"
- dropin "docker"
- exec_stop "/sbin/shorewall $OPTIONS stop"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/default/shorewall" do
- source "shorewall-default.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/shorewall.conf" do
- source "shorewall.conf.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/zones" do
- source "shorewall-zones.erb"
- owner "root"
- group "root"
- mode "644"
- variables :type => "ipv4"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/interfaces" do
- source "shorewall-interfaces.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/hosts" do
- source "shorewall-hosts.erb"
- owner "root"
- group "root"
- mode "644"
- variables :zones => zones
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/conntrack" do
- source "shorewall-conntrack.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
- only_if { node[:networking][:firewall][:raw] }
-end
-
-template "/etc/shorewall/policy" do
- source "shorewall-policy.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/rules" do
- source "shorewall-rules.erb"
- owner "root"
- group "root"
- mode "644"
- variables :family => "inet"
- notifies :restart, "service[shorewall]"
-end
-
-template "/etc/shorewall/stoppedrules" do
- source "shorewall-stoppedrules.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
-end
-
-if node[:networking][:firewall][:enabled]
- service "shorewall" do
- action [:enable, :start]
- supports :restart => true
- status_command "shorewall status"
- ignore_failure true
- end
-else
- service "shorewall" do
- action [:disable, :stop]
- supports :restart => true
- status_command "shorewall status"
- ignore_failure true
- end
-end
-
-template "/etc/logrotate.d/shorewall" do
- source "logrotate.shorewall.erb"
- owner "root"
- group "root"
- mode "644"
- variables :name => "shorewall"
-end
+if node[:networking][:firewall][:engine] == "shorewall"
+ package "shorewall"
-firewall_rule "limit-icmp-echo" do
- action :accept
- family :inet
- source "net"
- dest "fw"
- proto "icmp"
- dest_ports "echo-request"
- rate_limit "s:1/sec:5"
-end
-
-if node[:networking][:wireguard][:enabled]
- wireguard_source = if node[:roles].include?("gateway")
- "net"
- else
- "osm"
- end
-
- firewall_rule "accept-wireguard" do
- action :accept
- source wireguard_source
- dest "fw"
- proto "udp"
- dest_ports "51820"
- source_ports "51820"
- end
-end
-
-file "/etc/shorewall/masq" do
- action :delete
-end
-
-file "/etc/shorewall/masq.bak" do
- action :delete
-end
-
-if node[:roles].include?("gateway")
- template "/etc/shorewall/snat" do
- source "shorewall-snat.erb"
- owner "root"
- group "root"
- mode "644"
- notifies :restart, "service[shorewall]"
- end
-else
- file "/etc/shorewall/snat" do
- action :delete
+ systemd_service "shorewall-docker" do
+ service "shorewall"
+ dropin "docker"
+ exec_stop "/sbin/shorewall $OPTIONS stop"
notifies :restart, "service[shorewall]"
end
-end
-
-unless node.interfaces(:family => :inet6).empty?
- package "shorewall6"
- template "/etc/default/shorewall6" do
+ template "/etc/default/shorewall" do
source "shorewall-default.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/shorewall6.conf" do
- source "shorewall6.conf.erb"
+ template "/etc/shorewall/shorewall.conf" do
+ source "shorewall.conf.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/zones" do
+ template "/etc/shorewall/zones" do
source "shorewall-zones.erb"
owner "root"
group "root"
mode "644"
- variables :type => "ipv6"
- notifies :restart, "service[shorewall6]"
+ variables :type => "ipv4"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/interfaces" do
- source "shorewall6-interfaces.erb"
+ template "/etc/shorewall/interfaces" do
+ source "shorewall-interfaces.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/hosts" do
- source "shorewall6-hosts.erb"
+ template "/etc/shorewall/hosts" do
+ source "shorewall-hosts.erb"
owner "root"
group "root"
mode "644"
variables :zones => zones
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/conntrack" do
+ template "/etc/shorewall/conntrack" do
source "shorewall-conntrack.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
only_if { node[:networking][:firewall][:raw] }
end
- template "/etc/shorewall6/policy" do
+ template "/etc/shorewall/policy" do
source "shorewall-policy.erb"
owner "root"
group "root"
mode "644"
- notifies :restart, "service[shorewall6]"
+ notifies :restart, "service[shorewall]"
end
- template "/etc/shorewall6/rules" do
+ template "/etc/shorewall/rules" do
source "shorewall-rules.erb"
owner "root"
group "root"
mode "644"
- variables :family => "inet6"
- notifies :restart, "service[shorewall6]"
+ variables :family => "inet"
+ notifies :restart, "service[shorewall]"
+ end
+
+ template "/etc/shorewall/stoppedrules" do
+ source "shorewall-stoppedrules.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall]"
end
if node[:networking][:firewall][:enabled]
- service "shorewall6" do
+ service "shorewall" do
action [:enable, :start]
supports :restart => true
- status_command "shorewall6 status"
+ status_command "shorewall status"
ignore_failure true
end
else
- service "shorewall6" do
+ service "shorewall" do
action [:disable, :stop]
supports :restart => true
- status_command "shorewall6 status"
+ status_command "shorewall status"
ignore_failure true
end
end
- template "/etc/logrotate.d/shorewall6" do
+ template "/etc/logrotate.d/shorewall" do
source "logrotate.shorewall.erb"
owner "root"
group "root"
mode "644"
- variables :name => "shorewall6"
+ variables :name => "shorewall"
end
- firewall_rule "limit-icmp6-echo" do
+ firewall_rule "limit-icmp-echo" do
action :accept
- family :inet6
+ family :inet
source "net"
dest "fw"
- proto "ipv6-icmp"
+ proto "icmp"
dest_ports "echo-request"
rate_limit "s:1/sec:5"
end
+
+ file "/etc/shorewall/masq" do
+ action :delete
+ end
+
+ file "/etc/shorewall/masq.bak" do
+ action :delete
+ end
+
+ if node[:roles].include?("gateway")
+ template "/etc/shorewall/snat" do
+ source "shorewall-snat.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall]"
+ end
+ else
+ file "/etc/shorewall/snat" do
+ action :delete
+ notifies :restart, "service[shorewall]"
+ end
+ end
+
+ unless node.interfaces(:family => :inet6).empty?
+ package "shorewall6"
+
+ template "/etc/default/shorewall6" do
+ source "shorewall-default.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/shorewall6.conf" do
+ source "shorewall6.conf.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/zones" do
+ source "shorewall-zones.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :type => "ipv6"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/interfaces" do
+ source "shorewall6-interfaces.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/hosts" do
+ source "shorewall6-hosts.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :zones => zones
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/conntrack" do
+ source "shorewall-conntrack.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ only_if { node[:networking][:firewall][:raw] }
+ end
+
+ template "/etc/shorewall6/policy" do
+ source "shorewall-policy.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ template "/etc/shorewall6/rules" do
+ source "shorewall-rules.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :family => "inet6"
+ notifies :restart, "service[shorewall6]"
+ end
+
+ if node[:networking][:firewall][:enabled]
+ service "shorewall6" do
+ action [:enable, :start]
+ supports :restart => true
+ status_command "shorewall6 status"
+ ignore_failure true
+ end
+ else
+ service "shorewall6" do
+ action [:disable, :stop]
+ supports :restart => true
+ status_command "shorewall6 status"
+ ignore_failure true
+ end
+ end
+
+ template "/etc/logrotate.d/shorewall6" do
+ source "logrotate.shorewall.erb"
+ owner "root"
+ group "root"
+ mode "644"
+ variables :name => "shorewall6"
+ end
+
+ firewall_rule "limit-icmp6-echo" do
+ action :accept
+ family :inet6
+ source "net"
+ dest "fw"
+ proto "ipv6-icmp"
+ dest_ports "echo-request"
+ rate_limit "s:1/sec:5"
+ end
+ end
+elsif node[:networking][:firewall][:engine] == "nftables"
+ service "shorewall6" do
+ action :stop
+ end
+
+ package "shorewall6" do
+ action :purge
+ end
+
+ service "shorewall" do
+ action :stop
+ end
+
+ systemd_service "shorewall-docker" do
+ action :delete
+ service "shorewall"
+ dropin "docker"
+ end
+
+ package "shorewall" do
+ action :purge
+ end
+
+ package "nftables"
+
+ interfaces = []
+
+ node.interfaces(:role => :external).each do |interface|
+ interfaces << interface[:interface]
+ end
+
+ interfaces << "eth0" if kitchen? && interfaces.empty?
+
+ template "/etc/nftables.conf" do
+ source "nftables.conf.erb"
+ owner "root"
+ group "root"
+ mode "755"
+ variables :interfaces => interfaces, :hosts => hosts
+ notifies :restart, "service[nftables]"
+ end
+
+ stop_commands = [
+ "/usr/sbin/nft delete table inet filter"
+ ]
+
+ stop_commands << "/usr/sbin/nft delete table ip nat" if node[:roles].include?("gateway")
+
+ systemd_service "nftables-stop" do
+ service "nftables"
+ dropin "stop"
+ exec_reload ""
+ exec_stop stop_commands
+ end
+
+ if node[:networking][:firewall][:enabled]
+ service "nftables" do
+ action [:enable, :start]
+ end
+ else
+ service "nftables" do
+ action [:disable, :stop]
+ end
+ end
+end
+
+if node[:networking][:wireguard][:enabled]
+ wireguard_source = if node[:roles].include?("gateway")
+ "net"
+ else
+ "osm"
+ end
+
+ firewall_rule "accept-wireguard" do
+ action :accept
+ source wireguard_source
+ dest "fw"
+ proto "udp"
+ dest_ports "51820"
+ source_ports "51820"
+ end
end
firewall_rule "accept-http" do
projects / chef.git / blobdiff