X-Git-Url: https://git.openstreetmap.org./chef.git/blobdiff_plain/261e7e9cd1a9882faa4ed7087b5902ebafe25988..571e5982cc82c4fbefff0d463895a029a68921fe:/cookbooks/rsyncd/recipes/default.rb diff --git a/cookbooks/rsyncd/recipes/default.rb b/cookbooks/rsyncd/recipes/default.rb index 44fef331e..89ee45909 100644 --- a/cookbooks/rsyncd/recipes/default.rb +++ b/cookbooks/rsyncd/recipes/default.rb @@ -1,14 +1,14 @@ # -# Cookbook Name:: rsyncd +# Cookbook:: rsyncd # Recipe:: default # -# Copyright 2011, OpenStreetMap Foundation +# Copyright:: 2011, OpenStreetMap Foundation # # Licensed under the Apache License, Version 2.0 (the "License"); # you may not use this file except in compliance with the License. # You may obtain a copy of the License at # -# http://www.apache.org/licenses/LICENSE-2.0 +# https://www.apache.org/licenses/LICENSE-2.0 # # Unless required by applicable law or agreed to in writing, software # distributed under the License is distributed on an "AS IS" BASIS, @@ -19,10 +19,13 @@ include_recipe "networking" -hosts_allow = Hash.new -hosts_deny = Hash.new +writable_paths = [] +hosts_allow = {} +hosts_deny = {} + +node[:rsyncd][:modules].each do |name, details| + writable_paths << details[:path] if details[:write_only] -node[:rsyncd][:modules].each do |name,details| hosts_allow[name] = details[:hosts_allow] || [] if details[:nodes_allow] @@ -33,17 +36,26 @@ node[:rsyncd][:modules].each do |name,details| hosts_deny[name] = details[:hosts_deny] || [] - if details[:nodes_deny] - hosts_deny[name] |= search(:node, details[:nodes_deny]).collect do |n| - n.ipaddresses(:role => :external) - end.flatten - end + next unless details[:nodes_deny] + + hosts_deny[name] |= search(:node, details[:nodes_deny]).collect do |n| + n.ipaddresses(:role => :external) + end.flatten end package "rsync" +systemd_service "rsync-override" do + service "rsync" + dropin "override" + exec_start "/usr/bin/rsync --daemon --no-detach" + nice 10 + read_write_paths writable_paths.sort + notifies :restart, "service[rsync]" +end + service "rsync" do - action [ :enable, :start ] + action [:enable, :start] supports :status => true, :restart => true end @@ -51,7 +63,7 @@ template "/etc/default/rsync" do source "rsync.erb" owner "root" group "root" - mode 0644 + mode "644" notifies :restart, "service[rsync]" end @@ -59,15 +71,14 @@ template "/etc/rsyncd.conf" do source "rsyncd.conf.erb" owner "root" group "root" - mode 0644 + mode "644" variables :hosts_allow => hosts_allow, :hosts_deny => hosts_deny end firewall_rule "accept-rsync" do action :accept - source "net" - dest "fw" - proto "tcp:syn" + context :incoming + protocol :tcp dest_ports "rsync" - source_ports "1024:" + source_ports "1024-65535" end