Skip to content

Commit 148770f

Browse files
bastelfreakbastelfreak
authored
Merge pull request #296 from bastelfreak/choria
Add rule for outgoing choria connections
2 parents 00bba7e + a7b22fb commit 148770f

File tree

4 files changed

+191
-0
lines changed

4 files changed

+191
-0
lines changed

‎REFERENCE.md‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,7 @@ Enable this option to support Ceph's Monitor Daemon.
4242
Enable this to be a client of Ceph's Monitor (MON),
4343
Object Storage Daemons (OSD), Metadata Server Daemons (MDS),
4444
and Manager Daemons (MGR).
45+
* [`nftables::rules::out::choria`](#nftables--rules--out--choria): manage outgoing connections to choria brokers
4546
* [`nftables::rules::out::chrony`](#nftables--rules--out--chrony): manage out chrony
4647
* [`nftables::rules::out::dhcp`](#nftables--rules--out--dhcp): manage out dhcp
4748
* [`nftables::rules::out::dhcpv6_client`](#nftables--rules--out--dhcpv6_client): Allow DHCPv6 requests out of a host
@@ -1028,6 +1029,54 @@ Specify ports to open
10281029

10291030
Default value: `[3300, 6789]`
10301031

1032+
### <a name="nftables--rules--out--choria"></a>`nftables::rules::out::choria`
1033+
1034+
manage outgoing connections to choria brokers
1035+
1036+
* **See also**
1037+
* https://choria.io/docs/deployment/broker/
1038+
1039+
#### Parameters
1040+
1041+
The following parameters are available in the `nftables::rules::out::choria` class:
1042+
1043+
* [`brokers`](#-nftables--rules--out--choria--brokers)
1044+
* [`choria_port`](#-nftables--rules--out--choria--choria_port)
1045+
* [`websocket_port`](#-nftables--rules--out--choria--websocket_port)
1046+
* [`enable_websockets`](#-nftables--rules--out--choria--enable_websockets)
1047+
1048+
##### <a name="-nftables--rules--out--choria--brokers"></a>`brokers`
1049+
1050+
Data type: `Array[Stdlib::IP::Address]`
1051+
1052+
list of brokers where you want to connect to
1053+
1054+
Default value: `[]`
1055+
1056+
##### <a name="-nftables--rules--out--choria--choria_port"></a>`choria_port`
1057+
1058+
Data type: `Stdlib::Port`
1059+
1060+
where the broker listens for incoming server connections
1061+
1062+
Default value: `4222`
1063+
1064+
##### <a name="-nftables--rules--out--choria--websocket_port"></a>`websocket_port`
1065+
1066+
Data type: `Stdlib::Port`
1067+
1068+
where the broker listens for incoming websocket connections from servers
1069+
1070+
Default value: `4333`
1071+
1072+
##### <a name="-nftables--rules--out--choria--enable_websockets"></a>`enable_websockets`
1073+
1074+
Data type: `Boolean`
1075+
1076+
websockets are optional and use a different port
1077+
1078+
Default value: `true`
1079+
10311080
### <a name="nftables--rules--out--chrony"></a>`nftables::rules::out::chrony`
10321081

10331082
manage out chrony

‎manifests/rules/out/choria.pp‎

Lines changed: 53 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,53 @@
1+
#
2+
# @summary manage outgoing connections to choria brokers
3+
#
4+
# @param brokers list of brokers where you want to connect to
5+
# @param choria_port where the broker listens for incoming server connections
6+
# @param websocket_port where the broker listens for incoming websocket connections from servers
7+
# @param enable_websockets websockets are optional and use a different port
8+
#
9+
# @see https://choria.io/docs/deployment/broker/
10+
#
11+
# @author Tim Meusel <tim@bastelfreak.de>
12+
#
13+
class nftables::rules::out::choria (
14+
Array[Stdlib::IP::Address] $brokers = [],
15+
Stdlib::Port $choria_port = 4222,
16+
Stdlib::Port $websocket_port = 4333,
17+
Boolean $enable_websockets = true,
18+
) {
19+
if empty($brokers) {
20+
nftables::rule { 'default_out-choria-0':
21+
content => "tcp dport ${choria_port} accept",
22+
}
23+
if $enable_websockets {
24+
nftables::rule { 'default_out-choriawebsocket-0':
25+
content => "tcp dport ${choria_port} accept",
26+
}
27+
}
28+
}
29+
else {
30+
$brokers.each |$index,$ip| {
31+
if $ip =~ Stdlib::IP::Address::V6 {
32+
nftables::rule { "default_out-choria-${index}":
33+
content => "ip6 daddr ${ip} tcp dport ${choria_port} accept",
34+
}
35+
} else {
36+
nftables::rule { "default_out-choria-${index}":
37+
content => "ip daddr ${ip} tcp dport ${choria_port} accept",
38+
}
39+
}
40+
if $enable_websockets {
41+
if $ip =~ Stdlib::IP::Address::V6 {
42+
nftables::rule { "default_out-choriawebsocket-${index}":
43+
content => "ip6 daddr ${ip} tcp dport ${websocket_port} accept",
44+
}
45+
} else {
46+
nftables::rule { "default_out-choriawebsocket-${index}":
47+
content => "ip daddr ${ip} tcp dport ${websocket_port} accept",
48+
}
49+
}
50+
}
51+
}
52+
}
53+
}

‎spec/acceptance/all_rules_spec.rb‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -114,6 +114,7 @@ class { 'nftables':
114114
include nftables::rules::out::mdns
115115
include nftables::rules::out::ssdp
116116
include nftables::rules::out::icinga2
117+
include nftables::rules::out::choria
117118
include nftables::services::dhcpv6_client
118119
include nftables::services::openafs_client
119120
$config_path = $facts['os']['family'] ? {

‎spec/classes/rules/out/choria_spec.rb‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
# frozen_string_literal: true
2+
3+
require 'spec_helper'
4+
5+
describe 'nftables::rules::out::choria' do
6+
on_supported_os.each do |os, os_facts|
7+
context "on #{os}" do
8+
let(:facts) { os_facts }
9+
let(:params) do
10+
{ brokers: ['1.2.3.4'] }
11+
end
12+
13+
context 'default options' do
14+
it { is_expected.to compile }
15+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('ip daddr 1.2.3.4 tcp dport 4222 accept') }
16+
it { is_expected.to contain_nftables__rule('default_out-choriawebsocket-0').with_content('ip daddr 1.2.3.4 tcp dport 4333 accept') }
17+
it { is_expected.to have_nftables__rule_resource_count(2) }
18+
end
19+
20+
context 'with different port' do
21+
let(:params) do
22+
super().merge({ choria_port: 8141 })
23+
end
24+
25+
it { is_expected.to compile }
26+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('ip daddr 1.2.3.4 tcp dport 8141 accept') }
27+
it { is_expected.to contain_nftables__rule('default_out-choriawebsocket-0').with_content('ip daddr 1.2.3.4 tcp dport 4333 accept') }
28+
it { is_expected.to have_nftables__rule_resource_count(2) }
29+
end
30+
31+
context 'with ipv6 address' do
32+
let(:params) do
33+
{ brokers: ['fe80::1'] }
34+
end
35+
36+
it { is_expected.to compile }
37+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('ip6 daddr fe80::1 tcp dport 4222 accept') }
38+
it { is_expected.to contain_nftables__rule('default_out-choriawebsocket-0').with_content('ip6 daddr fe80::1 tcp dport 4333 accept') }
39+
it { is_expected.to have_nftables__rule_resource_count(2) }
40+
end
41+
42+
context 'with ipv6 & ipv4 address' do
43+
let(:params) do
44+
{ brokers: ['fe80::1', '1.2.3.4'] }
45+
end
46+
47+
it { is_expected.to compile }
48+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('ip6 daddr fe80::1 tcp dport 4222 accept') }
49+
it { is_expected.to contain_nftables__rule('default_out-choria-1').with_content('ip daddr 1.2.3.4 tcp dport 4222 accept') }
50+
it { is_expected.to contain_nftables__rule('default_out-choriawebsocket-0').with_content('ip6 daddr fe80::1 tcp dport 4333 accept') }
51+
it { is_expected.to contain_nftables__rule('default_out-choriawebsocket-1').with_content('ip daddr 1.2.3.4 tcp dport 4333 accept') }
52+
it { is_expected.to have_nftables__rule_resource_count(4) }
53+
end
54+
55+
context 'with ipv6 & ipv4 address & without websockets' do
56+
let(:params) do
57+
{ brokers: ['fe80::1', '1.2.3.4'], enable_websockets: false }
58+
end
59+
60+
it { is_expected.to compile }
61+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('ip6 daddr fe80::1 tcp dport 4222 accept') }
62+
it { is_expected.to contain_nftables__rule('default_out-choria-1').with_content('ip daddr 1.2.3.4 tcp dport 4222 accept') }
63+
it { is_expected.to have_nftables__rule_resource_count(2) }
64+
end
65+
66+
context 'without IPs' do
67+
let :params do
68+
{}
69+
end
70+
71+
it { is_expected.to compile }
72+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('tcp dport 4222 accept') }
73+
it { is_expected.not_to contain_nftables__rule('default_out-choriawebsocket-0').with_content('tcp dport 4333 accept') }
74+
it { is_expected.to have_nftables__rule_resource_count(2) }
75+
end
76+
77+
context 'without IPs & websockets' do
78+
let :params do
79+
{ enable_websockets: false }
80+
end
81+
82+
it { is_expected.to compile }
83+
it { is_expected.to contain_nftables__rule('default_out-choria-0').with_content('tcp dport 4222 accept') }
84+
it { is_expected.to have_nftables__rule_resource_count(1) }
85+
end
86+
end
87+
end
88+
end

0 commit comments

Comments
 (0)