Process firewall_rule resources at compile time

This allows us to avoid deferring the creation of the shorewall
configuration and hence prevent it restarting with a partial set
of rules when something else fails.

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index eba2208f5cf4f631ccd59fd13eada9b9ca9f55fb..8eed59556e415b854d03e7dcc8d3d77079e1d6cb 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -428,7 +428,6 @@ template "/etc/shorewall/policy" do
 end
 
 template "/etc/shorewall/rules" do
-  action :nothing
   source "shorewall-rules.erb"
   owner "root"
   group "root"
@@ -437,11 +436,6 @@ template "/etc/shorewall/rules" do
   notifies :restart, "service[shorewall]"
 end
 
-notify_group "shorewall-rules" do
-  action :run
-  notifies :create, "template[/etc/shorewall/rules]"
-end
-
 if node[:networking][:firewall][:enabled]
   service "shorewall" do
     action [:enable, :start]
@@ -571,7 +565,6 @@ unless node.interfaces(:family => :inet6).empty?
   end
 
   template "/etc/shorewall6/rules" do
-    action :nothing
     source "shorewall-rules.erb"
     owner "root"
     group "root"
@@ -580,11 +573,6 @@ unless node.interfaces(:family => :inet6).empty?
     notifies :restart, "service[shorewall6]"
   end
 
-  notify_group "shorewall6-rules" do
-    action :run
-    notifies :create, "template[/etc/shorewall6/rules]"
-  end
-
   if node[:networking][:firewall][:enabled]
     service "shorewall6" do
       action [:enable, :start]

diff --git a/cookbooks/networking/resources/firewall_rule.rb b/cookbooks/networking/resources/firewall_rule.rb
index 7cac9f86e4c94ffccdc7a05b42fae8103acfb93e..e92681ec7601fc08364a6e3fd66f96459f47aed8 100644 (file)
--- a/cookbooks/networking/resources/firewall_rule.rb
+++ b/cookbooks/networking/resources/firewall_rule.rb
@@ -33,6 +33,8 @@ property :rate_limit, :kind_of => String, :default => "-"
 property :connection_limit, :kind_of => [String, Integer], :default => "-"
 property :helper, :kind_of => String, :default => "-"
 
+property :compile_time, TrueClass, :default => true
+
 action :accept do
   add_rule :accept
 end