From f7eea382e7a2a4964cc97251bc7ab977bddb7b95 Mon Sep 17 00:00:00 2001 From: Tom Hughes Date: Wed, 2 Oct 2013 19:11:35 +0100 Subject: [PATCH 1/1] Allow access to a git server to be restricted to certain nodes --- cookbooks/git/recipes/server.rb | 30 +++++++++++++++++++++++------- 1 file changed, 23 insertions(+), 7 deletions(-) diff --git a/cookbooks/git/recipes/server.rb b/cookbooks/git/recipes/server.rb index 12b576aa1..4f537e62d 100644 --- a/cookbooks/git/recipes/server.rb +++ b/cookbooks/git/recipes/server.rb @@ -27,13 +27,29 @@ directory git_directory do mode 02775 end -firewall_rule "accept-git" do - action :accept - source "net" - dest "fw" - proto "tcp:syn" - dest_ports "git" - source_ports "1024:" +if node[:git][:allowed_nodes] + search(:node, node[:git][:allowed_nodes]).each do |n| + n.interfaces(:role => :external).each do |interface| + firewall_rule "accept-git" do + action :accept + family interface[:family] + source "#{interface[:zone]}:#{interface[:address]}" + dest "fw" + proto "tcp:syn" + dest_ports "git" + source_ports "1024:" + end + end + end +else + firewall_rule "accept-git" do + action :accept + source "net" + dest "fw" + proto "tcp:syn" + dest_ports "git" + source_ports "1024:" + end end Dir.new(git_directory).select { |name| name =~ /\.git$/ }.each do |repository| -- 2.43.2