P:puppet::server: Restrict source addresses for puppet-sync keys

Author: supertassu

modules/profile/manifests/puppet/server.pp

@@ -265,7 +265,7 @@
       user    => 'root',
       type    => $key.split(' ')[0],
       key     => $key.split(' ')[1],
-      options => ['restrict'],
+      options => ['restrict', ssh::client::from_restriction()],
       tag     => 'profile::puppet::server::puppet_sync',
     }
   }

modules/ssh/functions/client/from_restriction.pp

@@ -0,0 +1,10 @@
+# @summary constructs a ssh authorized_keys from= restriction
+#  for connections from this machine.
+function ssh::client::from_restriction () >> String[1] {
+  $ips = [$facts['networking']['ip'], $facts['networking']['ip6']].filter |$x| {
+    # check if we have a routable IPv6 address (and not just a link-local one)
+    $x =~ NotUndef and !($x =~ /^fe80/)
+  }.sort
+
+  "from=\"${ips.join(',')}\""
+}