cloud-mu 1.9.0.pre.beta

data/cookbooks/mu-master/recipes/basepackages.rb

@@ -0,0 +1,58 @@
+# Cookbook Name:: mu-master
+# Recipe:: basepackages
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This recipe is meant to be invoked standalone, by chef-apply. It can safely
+# be invoked during a regular chef-client run.
+#
+# When modifying this recipe, DO NOT ADD EXTERNAL DEPENDENCIES. That means no
+# references to other cookbooks, no include_recipes, no cookbook_files, no
+# templates.
+
+basepackages = []
+removepackages = []
+rpms = {}
+dpkgs = {}
+
+if platform_family?("rhel") 
+  basepackages = ["vim-enhanced", "zip", "unzip", "java-1.8.0-openjdk", "libxml2-devel", "libxslt-devel", "cryptsetup-luks", "python-pip", "lsof", "mlocate", "strace", "nmap", "openssl-devel", "readline-devel", "python-devel", "diffutils", "patch", "bind-utils", "httpd-tools", "mailx", "openssl", "libyaml", "graphviz", "ImageMagick-devel", "graphviz-devel", "jq", "vim", "libffi-devel"]
+
+  if node['platform_version'].to_i < 6 or node['platform_version'].to_i >= 8
+    raise "Mu Masters on RHEL-family hosts must be equivalent to RHEL6 or RHEL7"
+
+  # RHEL6, CentOS6, Amazon Linux
+  elsif node['platform_version'].to_i < 7
+    basepackages.concat(["java-1.5.0-gcj", "mysql-server", "autoconf"])
+    basepackages << "gecode-devel" if node['platform'] == "amazon"
+
+  # RHEL7, CentOS7
+  elsif node['platform_version'].to_i < 8
+    basepackages.concat(["gecode-devel", "mariadb", "qt", "qt-x11", "iptables-services"])
+  end
+
+else
+  raise "Mu Masters are currently only supported on RHEL-family hosts."
+end
+
+package basepackages
+rpms.each_pair { |pkg, src|
+  rpm_package pkg do
+    source src
+  end
+}
+package removepackages do
+  action :remove
+end

data/cookbooks/mu-master/recipes/caching_nameserver.rb

@@ -0,0 +1,37 @@
+#
+# Cookbook Name:: mu-master
+# Recipe:: caching_nameserver
+#
+# Copyright:: Copyright (c) 2015 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+package "bind"
+package "bind-devel"
+package "bind-utils"
+
+include_recipe 'bind'
+
+# XXX THIS RECIPE IS INCOMPLETE. DON'T INVOKE IT AND EXPECT ANYTHING USEFUL xxx
+
+hosts = {
+  "master" => "127.0.0.1",
+  "mu-master" => "127.0.0.1",
+  $MU_CFG['hostname'] => "127.0.0.1"
+}
+
+bind9_ng_zone "platform-mu" do
+  email $MU_CFG['mu_admin_email'].gsub(/@/, ".")
+  nameserver ["127.0.0.1"]
+  hosts hosts
+end

data/cookbooks/mu-master/recipes/default.rb

@@ -0,0 +1,451 @@
+#
+# Cookbook Name:: mu-master
+# Recipe:: default
+#
+# Copyright:: Copyright (c) 2014 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# XXX this is nonsense if we're not in AWS
+response = Net::HTTP.get_response(URI("http://169.254.169.254/latest/meta-data/instance-id"))
+instance_id = response.body
+search_domains = ["ec2.internal", "sclearerver.#{instance_id}.platform-mu", "platform-mu"]
+
+include_recipe 'mu-master::init'
+include_recipe 'mu-master::basepackages'
+include_recipe 'mu-master::firewall-holes'
+include_recipe 'mu-master::ssl-certs'
+include_recipe 'mu-master::vault'
+include_recipe 'mu-tools::gcloud'
+include_recipe 'mu-master::eks-kubectl'
+
+master_ips = get_mu_master_ips
+master_ips << "127.0.0.1"
+master_ips.uniq!
+master_ips.each { |host|
+  firewall_rule "Mu Master ports for self (#{host})" do
+    source "#{host}/32"
+  end
+  if host.match(/^(?:10\.|172\.(1[6789]|2[0-9]|3[01])\.|192\.168\.)/)
+    hostsfile_entry host do
+      hostname $MU_CFG['hostname']
+      aliases [node.name, "MU-MASTER"]
+      action :append
+    end
+  end
+}
+
+["#{$MU_CFG['installdir']}/etc/mu.yaml", "#{$MU_CFG['installdir']}/lib/Berksfile.lock"].each { |f|
+  file f do
+    mode 0644
+  end
+}
+
+if !node['update_nagios_only']
+
+  include_recipe 'chef-vault'
+  if $MU_CFG.has_key?('ldap')
+    if $MU_CFG['ldap']['type'] == "389 Directory Services" and Dir.exists?("/etc/dirsrv/slapd-#{$MU_CFG['hostname']}")
+      include_recipe 'mu-master::sssd'
+    elsif $MU_CFG['ldap']['type'] == "Active Directory"
+      node.normal['ad'] = {}
+      node.normal['ad']['computer_name'] = "MU-MASTER"
+      node.normal['ad']['node_class'] = "mumaster"
+      node.normal['ad']['node_type'] = "domain_node"
+      node.normal['ad']['domain_operation'] = "join"
+      node.normal['ad']['domain_name'] = $MU_CFG['ldap']['domain_name']
+      search_domains << node.normal['ad']['domain_name']
+      node.normal['ad']['netbios_name'] = $MU_CFG['ldap']['domain_netbios_name']
+      node.normal['ad']['dcs'] = $MU_CFG['ldap']['dcs']
+      node.normal['ad']['domain_join_vault'] = $MU_CFG['ldap']['join_creds']['vault']
+      node.normal['ad']['domain_join_item'] = $MU_CFG['ldap']['join_creds']['item']
+      node.normal['ad']['domain_join_username_field'] = $MU_CFG['ldap']['join_creds']['username_field']
+      node.normal['ad']['domain_join_password_field'] = $MU_CFG['ldap']['join_creds']['password_field']
+      if !node['application_attributes']['sshd_allow_groups'].match(/(^|\s)#{$MU_CFG['ldap']['user_group_name']}(\s|$)/i)
+        node.normal['application_attributes']['sshd_allow_groups'] = node['application_attributes']['sshd_allow_groups']+" "+$MU_CFG['ldap']['user_group_name'].downcase
+      end
+      node.save
+      include_recipe "mu-activedirectory::domain-node"
+    end
+  end
+
+  execute "set Mu Master's hostname" do
+    command "PATH=/bin:/usr/bin hostname #{$MU_CFG['hostname']}"
+    not_if "PATH=/bin:/usr/bin hostname | grep '^#{$MU_CFG['hostname']}$'"
+  end
+
+  file "/etc/hostname" do
+    content "#{$MU_CFG['hostname']}\n"
+  end
+
+  execute "updating hostname in /etc/sysconfig/network" do
+    command "sed -i 's/^HOSTNAME=.*/HOSTNAME=#{$MU_CFG['hostname']}.platform-mu/' /etc/sysconfig/network"
+    not_if "grep '^HOSTNAME=#{$MU_CFG['hostname']}.platform-mu'"
+  end
+
+  sudoer_line = "%#{$MU_CFG['ldap']['admin_group_name']} ALL=(ALL) NOPASSWD: ALL"
+  execute "echo '#{sudoer_line}' >> /etc/sudoers" do
+    not_if "grep '^#{sudoer_line}$' /etc/sudoers"
+  end
+
+  cookbook_file "/root/.vimrc" do
+    source "vimrc"
+    action :create_if_missing
+  end
+
+  file "/etc/profile.d/usr_local_bin.sh" do
+    content "export PATH=\"${PATH}:/usr/local/bin\"\n"
+    mode 0644
+  end
+
+  cookbook_file "/var/www/html/cloudamatic.png" do
+    source "cloudamatic.png"
+    mode 0644
+  end
+
+  package "nagios" do
+    action :remove
+  end
+
+  # The Nagios cookbook will only rebuild if the main executable is missing, so
+  # remove it if we've got a version bump coming down the pike.
+  execute "remove old Nagios binary" do
+    command "rm -f /usr/sbin/nagios"
+    not_if "/usr/sbin/nagios -V | grep 'Nagios Core #{node['nagios']['server']['version']}'"
+  end
+end
+
+include_recipe "mu-master::update_nagios_only"
+
+if !node['update_nagios_only']
+  package "nagios-plugins-all"
+
+  directory "/home/nagios" do
+    owner "nagios"
+    mode 0711
+  end
+
+  directory "/home/nagios/.ssh" do
+    owner "nagios"
+    mode 0711
+  end
+
+  file "/home/nagios/.ssh/config" do
+    owner "nagios"
+    mode 0600
+  end
+
+  execute "dhclient-script" do
+    command "/sbin/dhclient-script"
+    action :nothing
+  end
+
+  service "network" do
+    action :nothing
+  end
+
+  if !$MU_CFG['public_address'].match(/^\d+\.\d+\.\d+\.\d+$/)
+    my_name = $MU_CFG['public_address'].dup
+    begin
+      search_domains << my_name.dup
+      my_name.sub!(/^[^\.]+?\./, "")
+    end while my_name.match(/\./)
+  end
+  template "/etc/dhcp/dhclient-eth0.conf" do
+    source "dhclient-eth0.conf.erb"
+    mode 0644
+    notifies :restart, "service[network]", :immediately unless %w{redhat centos}.include?(node['platform']) && node['platform_version'].to_i == 7
+    variables(
+      :search_domains => search_domains
+    )
+  end
+
+  svrname = node['hostname']
+  if !$MU_CFG['public_address'].match(/^\d+\.\d+\.\d+\.\d+$/)
+    svrname = $MU_CFG['public_address']
+  end
+
+  # nagios keeps disabling the default vhost, so let's make another one
+  include_recipe "apache2::mod_proxy"
+  include_recipe "apache2::mod_proxy_http"
+  include_recipe "apache2::mod_rewrite"
+  include_recipe "apache2::mod_ldap"
+  include_recipe "apache2::mod_authnz_ldap"
+  apache_site "default" do
+    enable false
+  end
+  execute "Allow net connect to local for apache" do
+    command "/usr/sbin/setsebool -P httpd_can_network_connect on"
+    not_if "/usr/sbin/getsebool httpd_can_network_connect | grep -cim1 ^.*on$"
+    notifies :reload, "service[apache2]", :delayed
+  end
+
+
+  web_app "mu_docs" do
+    server_name svrname
+    server_aliases [node['fqdn'], node['hostname'], node['local_hostname'], node['local_ipv4'], node['public_hostname'], node['public_ipv4']]
+    docroot "/var/www/html"
+    cookbook "mu-master"
+    notifies :reload, "service[apache2]", :delayed
+  end
+  web_app "https_proxy" do
+    server_name svrname
+    server_port "443"
+    server_aliases [node['fqdn'], node['hostname'], node['local_hostname'], node['local_ipv4'], node['public_hostname'], node['public_ipv4']]
+    docroot "/var/www/html"
+    cookbook "mu-master"
+    notifies :reload, "service[apache2]", :delayed
+  end
+
+  link "/etc/nagios3" do
+    to "/etc/nagios"
+    notifies :reload, "service[apache2]", :delayed
+  end
+
+  directory "/usr/lib64/nagios"
+
+  link "/usr/lib64/nagios/cgi-bin" do
+    to "/usr/lib/cgi-bin"
+    notifies :reload, "service[apache2]", :delayed
+  end
+
+  directory "/var/www/html/docs" do
+    owner "apache"
+    group "apache"
+  end
+
+  include_recipe "postfix"
+
+  # Use a real hostname for mail if we happen to have one assigned
+  if !MU.mu_public_addr.match(/^\d+\.\d+\.\d+\.\d+$/)
+    node.normal['postfix']['main']['myhostname'] = MU.mu_public_addr
+    node.normal['postfix']['main']['mydomain'] = MU.mu_public_addr.sub(/^.*?([^\.]+\.[^\.]+)$/, '\1')
+    node.normal['postfix']['main']['myorigin'] = MU.mu_public_addr.sub(/^.*?([^\.]+\.[^\.]+)$/, '\1')
+  else
+    node.normal['postfix']['main']['myhostname'] = $MU_CFG['hostname']
+    node.normal['postfix']['main']['mydomain'] = "platform-mu"
+    node.normal['postfix']['main']['myorigin'] = "platform-mu"
+  end
+  node.normal['postfix']['main']['inet_interfaces'] = "all"
+  node.save
+
+
+  file "/var/www/html/index.html" do
+    owner "apache"
+    group "apache"
+    content "
+
+   <h1>This is a Mu Master server</h2>
+
+  <p>
+   <a href='https://#{MU.mu_public_addr}/nagios/'>Nagios monitoring GUI</a>
+  </p>
+  <p>
+   <a href='https://#{MU.mu_public_addr}/jenkins/'>Jenkins interface GUI</a>
+  </p>
+  <p>
+   <a href='http://#{MU.mu_public_addr}/docs/frames.html'>Mu API documentation</a>
+  </p>
+  "
+  end
+
+  execute "echo 'devnull: /dev/null' >> /etc/aliases" do
+    not_if "grep '^devnull: /dev/null$' /etc/aliases"
+  end
+
+  directory "/Mu_Logs"
+
+  include_recipe "mu-tools::rsyslog"
+
+  cookbook_file "0-mu-log-server.conf" do
+    path "/etc/rsyslog.d/0-mu-log-server.conf"
+    notifies :restart, "service[rsyslog]", :delayed
+  end
+  file "0-mu-log-client.conf" do
+    path "/etc/rsyslog.d/0-mu-log-client.conf"
+    action :delete
+    notifies :restart, "service[rsyslog]", :delayed
+  end
+
+  execute "echo '/sbin/restorecon -r /home' >> /etc/rc.d/rc.local" do
+    not_if "grep '^/sbin/restorecon -r /home' /etc/rc.d/rc.local"
+  end
+  execute "echo '/opt/chef/bin/chef-client' >> /etc/rc.d/rc.local" do
+    not_if "grep ^/opt/chef/bin/chef-client /etc/rc.d/rc.local"
+  end
+
+  directory "/etc/pki/rsyslog"
+  ["Mu_CA.pem", "rsyslog.crt", "rsyslog.key"].each { |file|
+    execute "install rsyslog SSL cert file #{file}" do
+      command "cp -f #{MU.mainDataDir}/ssl/#{file} /etc/pki/rsyslog/#{file} && chmod 400 /etc/pki/rsyslog/#{file}"
+      not_if "diff #{MU.mainDataDir}/ssl/#{file} /etc/pki/rsyslog/#{file}"
+    end
+  }
+
+  package "logrotate"
+
+  file "/etc/logrotate.d/Mu_audit_logs" do
+    content "/Mu_Logs/master.log
+  /Mu_Logs/nodes.log
+  {
+    sharedscripts
+    daily
+    delaycompress
+    postrotate
+      #{MU.myRoot}/bin/mu-aws-setup -u
+      /bin/kill -HUP `cat /var/run/syslogd.pid 2> /dev/null` 2> /dev/null || true
+    endscript
+  }
+  "
+  end
+
+# XXX this will catch the occasional 4am groom. Need a way to graceful-restart momma.
+  file "/etc/logrotate.d/Mu_momma_cat" do
+    content "/var/log/mu-momma-cat.log
+  {
+    sharedscripts
+    size 100M
+    delaycompress
+    postrotate
+      /etc/init.d/mu-momma-cat restart
+    endscript
+  }
+  "
+  end
+
+  template "#{MU.etcDir}/mu.rc" do
+    source "mu.rc.erb"
+    mode 0644
+    owner "root"
+    variables(
+      :installdir => MU.installDir
+    )
+    not_if { ::File.size?("#{MU.etcDir}/mu.rc") }
+  end
+  execute "source #{MU.etcDir}/mu.rc from root dotfiles" do
+    command "echo 'source #{MU.etcDir}/mu.rc' >> #{Etc.getpwnam("root").dir}/.bashrc"
+    not_if "test -f #{Etc.getpwnam("root").dir}/.bashrc && grep '^source #{MU.etcDir}/mu.rc$' #{Etc.getpwnam("root").dir}/.bashrc"
+  end
+
+  begin
+    resources('service[sshd]')
+  rescue Chef::Exceptions::ResourceNotFound
+    service "sshd" do
+      action [:enable, :start]
+    end
+  end
+
+  template "Mu Master /etc/ssh/sshd_config" do
+    path "/etc/ssh/sshd_config"
+    source "sshd_config.erb"
+    mode 0600
+    owner "root"
+    group "root"
+    notifies :reload, "service[sshd]", :delayed
+    cookbook "mu-tools"
+  end
+
+  cron "Sync client firewall allow rules" do
+    action :create
+    minute "10"
+    user "root"
+    command "#{MU.installDir}/bin/mu-firewall-allow-clients"
+  end
+
+  # XXX bug in Chef vault is current purging basically all clients
+  cron "Rotate vault keys and purge MIA clients" do
+    action :delete
+    minute "10"
+    hour "6"
+    user "root"
+    command "/opt/mu/bin/knife vault rotate all keys --clean-unknown-clients"
+  end
+
+  # TODO fine if we're SysV-compatible, but cover the other guys
+  template "/etc/init.d/mu-momma-cat" do
+    source "mu-momma-cat.erb"
+    variables(
+      :installdir => MU.installDir,
+      :ssl_key => $MU_CFG['ssl']['key'],
+      :ssl_cert => $MU_CFG['ssl']['cert'],
+    )
+    mode 0755
+  end
+  link "/opt/mu/bin/mu-momma-cat" do
+    to "/etc/init.d/mu-momma-cat"
+  end
+  service "mu-momma-cat" do
+    action [:enable, :start]
+  end
+
+  # This is stuff that can break for no damn reason at all
+  include_recipe "mu-tools::cloudinit"
+
+
+  begin
+    node.normal['mu']['user_map'] = MU::Master.listUsers
+    node.normal['mu']['user_list'] = []
+    node['mu']['user_map'].each_pair { |user, data|
+      node.normal['mu']['user_list'] << "#{user} (#{data['email']})"
+    }
+    node.save
+  
+    file "/root/.gitconfig" do
+      content "[user]
+        name = #{node['mu']['user_map']['mu']['realname']}
+        email = #{node['mu']['user_map']['mu']['email']}
+[push]
+        default = current
+"
+    end
+  
+    # XXX placeholder- we should have a "federal" flag which invokes
+    # mu-tools::apply_security, which has its own gov-compliant /etc/issue.net
+    # The one that ships on CentOS images seems incorrect, so nuking it for now
+    file "/etc/issue.net" do
+      action :delete  
+    end
+
+    node['mu']['user_map'].each_pair { |mu_user, data|
+      execute "echo '#{mu_user}: #{data['email']}' >> /etc/aliases" do
+        not_if "grep '^#{mu_user}: #{data['email']}$' /etc/aliases"
+      end
+    }
+
+    file "/etc/motd" do
+      content "
+*******************************************************************************
+
+ This is a Mu Master server. Mu is installed in #{MU.myRoot}.
+
+ Nagios monitoring GUI: https://#{MU.mu_public_addr}/nagios/
+
+ Jenkins interface GUI: https://#{MU.mu_public_addr}/jenkins/
+
+ Mu API documentation: http://#{MU.mu_public_addr}/docs/frames.html
+
+ Mu metadata are stored in #{MU.mainDataDir}
+
+ Users: #{node['mu']['user_list'].join(", ")}
+
+*******************************************************************************
+
+"
+    end
+  rescue Exception
+    log "Can't list users" do
+      message "Doesn't seem like I can list available users. Hopefully this is initial setup."
+      level :warn
+    end
+  end
+end

data/cookbooks/mu-master/recipes/eks-kubectl.rb

@@ -0,0 +1,41 @@
+# Cookbook Name:: mu-master
+# Recipe:: eks-kubectl
+#
+# Copyright:: Copyright (c) 2018 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# This recipe is meant to be invoked standalone, by chef-apply. It can safely
+# be invoked during a regular chef-client run.
+#
+# When modifying this recipe, DO NOT ADD EXTERNAL DEPENDENCIES. That means no
+# references to other cookbooks, no include_recipes, no cookbook_files, no
+# templates.
+#
+remote_file "/opt/mu/bin/kubectl" do
+  source "https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/kubectl"
+  mode 0755
+  not_if "test -f /opt/mu/bin/kubectl"
+end
+
+remote_file "/opt/mu/bin/aws-iam-authenticator" do
+  source "https://amazon-eks.s3-us-west-2.amazonaws.com/1.10.3/2018-07-26/bin/linux/amd64/aws-iam-authenticator"
+  mode 0755
+  not_if "test -f /opt/mu/bin/aws-iam-authenticator"
+end
+
+# in brand new accounts where no load balancer has been created, something
+# has to do this before EKS has to, because by default it can't
+execute "aws iam create-service-linked-role --aws-service-name 'elasticloadbalancing.amazonaws.com'" do
+  not_if "aws iam list-roles | grep /aws-service-role/elasticloadbalancing.amazonaws.com/"
+end

data/cookbooks/mu-master/recipes/firewall-holes.rb

@@ -0,0 +1,70 @@
+#
+# Cookbook Name:: mu-master
+# Recipe:: firewall-holes
+#
+# Copyright:: Copyright (c) 2017 eGlobalTech, Inc., all rights reserved
+#
+# Licensed under the BSD-3 license (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License in the root of the project or at
+#
+#     http://egt-labs.com/mu/LICENSE.html
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+include_recipe 'mu-firewall'
+
+# TODO Move all mu firewall rules to a mu specific chain
+firewall_rule "MU Master default ports" do
+  port [2260, 7443, 8443, 9443, 10514, 443, 80, 25]
+end
+
+local_chef_ports = [4321, 9463, 9583, 16379, 8983, 8000, 9680, 9683, 9090, 5432]
+firewall_rule "Chef Server ports on 127.0.0.1" do
+  port local_chef_ports
+  source "127.0.0.1/32"
+end
+local_chef_ports_2 = [5672, 9999, 15672, 25672, 81, 111, 4369, 9463]
+firewall_rule "Chef Server ports on 127.0.0.1 (2)" do
+  port local_chef_ports_2
+  source "127.0.0.1/32"
+end
+if node.has_key?(:local_ipv4)
+  firewall_rule "Chef Server ports on #{node['local_ipv4']}" do
+    port local_chef_ports
+    source "#{node['local_ipv4']}/32"
+  end
+end
+
+firewall_rule "Mu Master LDAP ports" do
+  port [389, 636] # TODO 389 should probably be local-only
+end
+
+firewall_rule "Mu Master Vault ports" do
+  port [8200]
+end
+firewall_rule "Mu Master Consul ports on 127.0.0.1" do
+  port [8300, 8301, 8302, 8400, 8500, 8600]
+  source "127.0.0.1/32"
+end
+if node.has_key?(:local_ipv4)
+  firewall_rule "Mu Master Consul ports on #{node['local_ipv4']}" do
+    port [8300, 8301, 8302, 8400, 8500, 8600]
+    source "#{node['local_ipv4']}/32"
+  end
+end
+
+firewall_rule "Mu Master Jenkins ports on 127.0.0.1" do
+  port [8080]
+  source "127.0.0.1/32"
+end
+if node.has_key?(:local_ipv4)
+  firewall_rule "Mu Master Jenkins ports on #{node['local_ipv4']}" do
+    port [8080]
+    source "#{node['local_ipv4']}/32"
+  end
+end