X-Git-Url: https://git.openstreetmap.org/chef.git/blobdiff_plain/6701c75cd26e603cafa373db9ee75e6c099639e9..5a5dc07272ef6c3b475f0d0275d0890a7e0bca15:/cookbooks/networking/recipes/default.rb

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index fa3f97d00..41daefe7e 100644
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -236,7 +236,7 @@ if node[:networking][:wireguard][:enabled]
       }
     end
 
-    search(:node, "roles:mail") do |server|
+    search(:node, "roles:mail OR roles:prometheus") do |server|
       allowed_ips = server.interfaces(:role => :internal).map do |interface|
         "#{interface[:network]}/#{interface[:prefix]}"
       end
@@ -342,9 +342,14 @@ template "/etc/systemd/resolved.conf.d/99-chef.conf" do
   notifies :restart, "service[systemd-resolved]", :immediately
 end
 
+if node[:filesystem][:by_mountpoint][:"/etc/resolv.conf"]
+  execute "umount-resolve-conf" do
+    command "umount -c /etc/resolv.conf"
+  end
+end
+
 link "/etc/resolv.conf" do
   to "../run/systemd/resolve/stub-resolv.conf"
-  not_if { ENV["TEST_KITCHEN"] }
 end
 
 zones = {}
@@ -363,6 +368,13 @@ end
 
 package "shorewall"
 
+systemd_service "shorewall-docker" do
+  service "shorewall"
+  dropin "docker"
+  exec_stop "/sbin/shorewall $OPTIONS stop"
+  notifies :restart, "service[shorewall]"
+end
+
 template "/etc/default/shorewall" do
   source "shorewall-default.erb"
   owner "root"
@@ -423,7 +435,6 @@ template "/etc/shorewall/policy" do
 end
 
 template "/etc/shorewall/rules" do
-  action :nothing
   source "shorewall-rules.erb"
   owner "root"
   group "root"
@@ -432,22 +443,19 @@ template "/etc/shorewall/rules" do
   notifies :restart, "service[shorewall]"
 end
 
-notify_group "shorewall-rules" do
-  action :run
-  notifies :create, "template[/etc/shorewall/rules]"
-end
-
 if node[:networking][:firewall][:enabled]
   service "shorewall" do
     action [:enable, :start]
     supports :restart => true
     status_command "shorewall status"
+    ignore_failure true
   end
 else
   service "shorewall" do
     action [:disable, :stop]
     supports :restart => true
     status_command "shorewall status"
+    ignore_failure true
   end
 end
 
@@ -564,7 +572,6 @@ unless node.interfaces(:family => :inet6).empty?
   end
 
   template "/etc/shorewall6/rules" do
-    action :nothing
     source "shorewall-rules.erb"
     owner "root"
     group "root"
@@ -573,22 +580,19 @@ unless node.interfaces(:family => :inet6).empty?
     notifies :restart, "service[shorewall6]"
   end
 
-  notify_group "shorewall6-rules" do
-    action :run
-    notifies :create, "template[/etc/shorewall6/rules]"
-  end
-
   if node[:networking][:firewall][:enabled]
     service "shorewall6" do
       action [:enable, :start]
       supports :restart => true
       status_command "shorewall6 status"
+      ignore_failure true
     end
   else
     service "shorewall6" do
       action [:disable, :stop]
       supports :restart => true
       status_command "shorewall6 status"
+      ignore_failure true
     end
   end