Merge remote-tracking branch 'github/pull/440'

diff --git a/cookbooks/networking/recipes/default.rb b/cookbooks/networking/recipes/default.rb
index c24686d0b0344a2a968b8001d6a28b96f27371c4..c76d47e3e120bf91b4478b5f7e8d909dfeddf012 100644 (file)
--- a/cookbooks/networking/recipes/default.rb
+++ b/cookbooks/networking/recipes/default.rb
@@ -368,6 +368,13 @@ end
 
 package "shorewall"
 
+systemd_service "shorewall-docker" do
+  service "shorewall"
+  dropin "docker"
+  exec_stop "/sbin/shorewall $OPTIONS stop"
+  notifies :restart, "service[shorewall]"
+end
+
 template "/etc/default/shorewall" do
   source "shorewall-default.erb"
   owner "root"
@@ -436,6 +443,14 @@ template "/etc/shorewall/rules" do
   notifies :restart, "service[shorewall]"
 end
 
+template "/etc/shorewall/stoppedrules" do
+  source "shorewall-stoppedrules.erb"
+  owner "root"
+  group "root"
+  mode "644"
+  notifies :restart, "service[shorewall]"
+end
+
 if node[:networking][:firewall][:enabled]
   service "shorewall" do
     action [:enable, :start]

diff --git a/cookbooks/networking/templates/default/shorewall-interfaces.erb b/cookbooks/networking/templates/default/shorewall-interfaces.erb
index b6a7217270e226731eb789a0492f37ad72502f83..3090a47cc7af9a8dd306207bdde6aa9e991c5872 100644 (file)
--- a/cookbooks/networking/templates/default/shorewall-interfaces.erb
+++ b/cookbooks/networking/templates/default/shorewall-interfaces.erb
@@ -13,3 +13,4 @@ net   <%= interface[:interface] %>            nosmurfs,tcpflags
 <% end -%>
 <% end -%>
 loc    wg+             nosmurfs,tcpflags
+dock   docker0         bridge

diff --git a/cookbooks/networking/templates/default/shorewall-stoppedrules.erb b/cookbooks/networking/templates/default/shorewall-stoppedrules.erb
new file mode 100644 (file)
index 0000000..276e00a
--- /dev/null
+++ b/cookbooks/networking/templates/default/shorewall-stoppedrules.erb
@@ -0,0 +1,2 @@
+ACCEPT -       -
+ACCEPT -       $FW

diff --git a/cookbooks/networking/templates/default/shorewall-zones.erb b/cookbooks/networking/templates/default/shorewall-zones.erb
index d3d403c95ab17135a91d377b0279a784acdad5d5..72e004713582c7b4d9444991cd6a6c552d14ac02 100644 (file)
--- a/cookbooks/networking/templates/default/shorewall-zones.erb
+++ b/cookbooks/networking/templates/default/shorewall-zones.erb
@@ -4,6 +4,7 @@
 fw             firewall
 loc            <%= @type %>
 net            <%= @type %>
+dock           <%= @type %>
 osm:net                <%= @type %>
 ucl:osm                <%= @type %>
 ams:osm                <%= @type %>

diff --git a/cookbooks/networking/templates/default/shorewall.conf.erb b/cookbooks/networking/templates/default/shorewall.conf.erb
index 290c73fb64fd7e2f1184d5c679b9edf4b9de0eaa..1ec804b047d565a96582ad4a136f6158d7985964 100644 (file)
--- a/cookbooks/networking/templates/default/shorewall.conf.erb
+++ b/cookbooks/networking/templates/default/shorewall.conf.erb
@@ -166,7 +166,7 @@ DETECT_DNAT_IPADDRS=No
 
 DISABLE_IPV6=No
 
-DOCKER=No
+DOCKER=Yes
 
 DONT_LOAD=