Ignore failures starting shorewall

[chef.git] / cookbooks / networking / recipes / default.rb

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index 4fc08a61bf8d043fc818b64f0883d4c99c4475dd..eba2208f5cf4f631ccd59fd13eada9b9ca9f55fb 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -236,6 +236,22 @@ if node[:networking][:wireguard][:enabled]
       }
     end
 
+    search(:node, "roles:mail") do |server|
+      allowed_ips = server.interfaces(:role => :internal).map do |interface|
+        "#{interface[:network]}/#{interface[:prefix]}"
+      end
+
+      if server[:networking][:private_address]
+        allowed_ips << "#{server[:networking][:private_address]}/32"
+      end
+
+      node.default[:networking][:wireguard][:peers] << {
+        :public_key => server[:networking][:wireguard][:public_key],
+        :allowed_ips => allowed_ips,
+        :endpoint => "#{server.name}:51820"
+      }
+    end
+
     node.default[:networking][:wireguard][:peers] << {
       :public_key => "7Oj9ufNlgidyH/xDc+aHQKMjJPqTmD/ab13agMh6AxA=",
       :allowed_ips => "10.0.16.1/32",
@@ -327,9 +343,8 @@ template "/etc/systemd/resolved.conf.d/99-chef.conf" do
 end
 
 if node[:filesystem][:by_mountpoint][:"/etc/resolv.conf"]
-  mount "/etc/resolv.conf" do
-    action :umount
-    device node[:filesystem][:by_mountpoint][:"/etc/resolv.conf"][:devices].first
+  execute "umount-resolve-conf" do
+    command "umount -c /etc/resolv.conf"
   end
 end
 
@@ -432,12 +447,14 @@ if node[:networking][:firewall][:enabled]
     action [:enable, :start]
     supports :restart => true
     status_command "shorewall status"
+    ignore_failure true
   end
 else
   service "shorewall" do
     action [:disable, :stop]
     supports :restart => true
     status_command "shorewall status"
+    ignore_failure true
   end
 end
 
@@ -573,12 +590,14 @@ unless node.interfaces(:family => :inet6).empty?
       action [:enable, :start]
       supports :restart => true
       status_command "shorewall6 status"
+      ignore_failure true
     end
   else
     service "shorewall6" do
       action [:disable, :stop]
       supports :restart => true
       status_command "shorewall6 status"
+      ignore_failure true
     end
   end