dust-deploy 0.13.12 → 0.13.13

data/changelog.md

@@ -1,6 +1,13 @@
 Changelog
 =============
 
+0.13.13
+------------
+
+-  adds ssh_config recipe
+-  fixes iptables workaround issues for debian and openwrt, uses workaround for ipv6 only on debian
+
+
 0.13.12
 ------------
 

data/lib/dust/recipes/iptables.rb

@@ -32,8 +32,14 @@ class Iptables < Recipe
       generate_all_rules
 
       deploy_script
+      workaround_setup
+
       apply_rules if @options.restart?
     end
+
+    # deploy workarounds
+    workaround_exec
+    @node.autostart_service('iptables-persistent') if @node.uses_apt?
   end
 
   desc 'iptables:status', 'displays iptables rules'
@@ -250,50 +256,56 @@ class Iptables < Recipe
     # create directory if not existend
     @node.mkdir(File.dirname(target)) unless @node.dir_exists?(File.dirname(target), :quiet => true)
 
-    # overwrite openwrt firewall configuration
-    # and only use our script
-    if @node.uses_opkg?
-      @node.write '/etc/config/firewall',
-                  "config include\n\toption path /etc/firewall.sh\n"
+    @node.write(target, @script, :quiet => true)
+    @node.chmod('0600', target)
+  end
 
-      workaround_script = '/etc/firewall.sh'
+  def workaround_setup
+    # openwrt always needs the workaround
+    if @node.uses_opkg?
+      @workaround = { 'path' => '/etc/firewall.sh' }
 
     # iptables-persistent < version 0.5.1 doesn't support ipv6
     # so doing a workaround
-    elsif @node.uses_apt?
-      # check if iptables-persistent is new enough
+    elsif @node.uses_apt? and @ip_version == 6
       unless @node.package_min_version?('iptables-persistent', '0.5.1', :quiet => true)
-        @node.messages.add('iptables-persistent too old (< 0.5.1), using workaround').warning
-        workaround_script = '/etc/network/if-pre-up.d/iptables'
+        @node.messages.add('iptables-persistent too old (< 0.5.1), using workaround for ipv6').warning
+        @workaround = { 'path' => '/etc/network/if-pre-up.d/ip6tables' }
       end
     end
 
-    if workaround_script
-      msg = @node.messages.add("deploying workaround script to #{workaround_script}", :indent => 2)
-      msg.parse_result(@node.write(workaround_script,
-                                   "#!/bin/sh\n\n" +
-                                   "iptables-restore < #{target}\n" +
-                                   "ip6tables-restore < #{target}\n", :quiet => true))
+    return unless @workaround
 
-      @node.chmod('0700', workaround_script, :indent => 2)
+    @workaround['script'] ||= "#!/bin/sh\n\n"
+    @workaround['script'] << "iptables-restore < #{get_target}\n"
+  end
 
-      if @node.uses_apt?
-        # deactivate iptables-persistent initscript
-        msg = @node.messages.add('deactivating iptables-persistent initscript', :indent => 2)
-        msg.parse_result(@node.exec('update-rc.d iptables-persistent remove')[:exit_code])
-      end
-    else
-      @node.autostart_service('iptables-persistent') if @node.uses_apt?
-    end
+  def workaround_exec
+    return unless @workaround
 
-    # disable firewall hotplug scripts on openwrt
-    if @node.uses_opkg?
-      msg = @node.messages.add('disabling firewall hotplug scripts in /etc/hotplug.d/firewall')
+    @node.messages.add('deploying workarounds').warning
+    msg = @node.messages.add("deploying script to #{@workaround['path']}", :indent => 2)
+    msg.parse_result(@node.write(@workaround['path'], @workaround['script'], :quiet => true))
+    @node.chmod('0700', @workaround['path'], :indent => 2)
+
+    if @node.uses_apt?
+      # < 0.5.1 uses rules instead of rules.ipver
+      # remove old rules script and symlink it to ours
+      @node.messages.add('iptables-persistent < 0.5.1 uses rules instead of rules.v4, symlinking',
+                         :indent => 2).warning
+      @node.rm('/etc/iptables/rules', :indent => 3)
+      @node.symlink('/etc/iptables/rules.v4', '/etc/iptables/rules', :indent => 3)
+
+    elsif @node.uses_opkg?
+      # overwrite openwrt firewall configuration
+      # and only use our script
+      @node.write('/etc/config/firewall',
+                  "config include\n\toption path /etc/firewall.sh\n", :indent => 2)
+
+      # disable openwrt firewall hotplug scripts
+      msg = @node.messages.add('disabling firewall hotplug scripts in /etc/hotplug.d/firewall', :indent => 2)
       msg.parse_result(@node.exec('chmod -x /etc/hotplug.d/firewall/*')[:exit_code])
     end
-
-    @node.write(target, @script, :quiet => true)
-    @node.chmod('0600', target)
   end
 
   # apply newly pushed rules

data/lib/dust/recipes/ssh_config.rb

@@ -0,0 +1,48 @@
+class Ssh_config < Recipe
+
+  desc 'ssh_config:deploy', 'deploys /etc/ssh/ssh_config'
+  def deploy
+    return unless install
+    @config = @config.deep_merge(default_config)
+    @node.write('/etc/ssh/ssh_config', generate_ssh_config)
+  end
+
+
+  private
+
+  def install
+    return @node.install_package('openssh-client') if @node.uses_apt?
+    return @node.install_package('openssh-clients') if @node.uses_rpm?
+    return @node.install_package('openssh') if @node.uses_pacman?
+    false
+  end
+
+  def default_config
+    { 'Host *' =>
+      {
+        'ForwardX11Trusted' => 'yes',
+        'SendEnv' => [ 'LANG LC_*', 'XMODIFIERS' ],
+        'HashKnownHosts' => 'yes',
+        'GSSAPIAuthentication' => 'yes',
+        'GSSAPIDelegateCredentials' => 'no'
+      }
+    }
+  end
+
+  def generate_ssh_config
+    ssh_config = ''
+    @config.each do |key, value|
+
+      # hashes are blocks, indent them
+      if value.is_a? Hash
+        ssh_config << "#{key}\n"
+        value.each do |k, v|
+          v.to_array.each { |x| ssh_config << "    #{k} #{x}\n" }
+        end
+      else
+        value.to_array.each { |x| ssh_config << "#{key} #{x}\n" }
+      end
+    end
+    ssh_config
+  end
+end

data/lib/dust/version.rb

@@ -1,3 +1,3 @@
 module Dust
-  VERSION = "0.13.12"
+  VERSION = "0.13.13"
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: dust-deploy
 version: !ruby/object:Gem::Version
-  version: 0.13.12
+  version: 0.13.13
   prerelease: 
 platform: ruby
 authors:
@@ -9,7 +9,7 @@ authors:
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2012-06-29 00:00:00.000000000 Z
+date: 2012-07-02 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: json
@@ -200,6 +200,7 @@ files:
 - lib/dust/recipes/ruby_rvm.rb
 - lib/dust/recipes/skel.rb
 - lib/dust/recipes/ssh_authorized_keys.rb
+- lib/dust/recipes/ssh_config.rb
 - lib/dust/recipes/sshd.rb
 - lib/dust/recipes/sudoers.rb
 - lib/dust/recipes/sysctl.rb