Puppet Class: profile::ci::firewall

Defined in:
modules/profile/manifests/ci/firewall.pp

Overview

class contint::firewall

Parameters

Several bricks communicate with the Zuul Gearman server:

$zuul_merger_hosts

List of zuul-mergers

Parameters:

  • jenkins_master_hosts (Any) (defaults to: lookup('profile::ci::firewall::jenkins_master_hosts'))
  • zuul_merger_hosts (Any) (defaults to: lookup('profile::ci::firewall::zuul_merger_hosts'))


9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
# File 'modules/profile/manifests/ci/firewall.pp', line 9

class profile::ci::firewall (
    $jenkins_master_hosts = lookup('profile::ci::firewall::jenkins_master_hosts'),
    $zuul_merger_hosts = lookup('profile::ci::firewall::zuul_merger_hosts'),
) {
    class { '::profile::base::firewall': }
    include ::network::constants

    # Restrict some services to be only reacheable from localhost over both
    # IPv4 and IPv6 (to be safe)

    # Jenkins on port 8080, reacheable via Apache proxying the requests
    ferm::service { 'jenkins_localhost_only':
        proto  => 'tcp',
        port   => '8080',
        srange => '(127.0.0.1 ::1)',
    }

    # Zuul status page on port 8001, reacheable via Apache proxying the requests
    ferm::service { 'zuul_localhost_only':
        proto  => 'tcp',
        port   => '8001',
        srange => '(127.0.0.1 ::1)',
    }

    # Each master is an agent of the other
    $jenkins_master_hosts_ferm = join($jenkins_master_hosts, ' ')
    ferm::service { 'jenkins_masters_ssh':
        proto  => 'tcp',
        port   => '22',
        srange => "@resolve((${jenkins_master_hosts_ferm}))",
    }

    # Gearman is used between Zuul and the Jenkin master, both on the same
    # server and communicating over localhost.
    # It is also used by Zuul merger daemons.
    $zuul_merger_hosts_ferm = join($zuul_merger_hosts, ' ')

    ferm::service { 'gearman_from_zuul_mergers':
        proto  => 'tcp',
        port   => '4730',
        srange => "(${zuul_merger_hosts_ferm})",
    }

    # web access
    ferm::service { 'ci_http':
        proto  => 'tcp',
        port   => '80',
        srange => '$CACHES',
    }
}