Docker and forwarding classes

diff --git a/manifests/docker.pp b/manifests/docker.pp
new file mode 100644 (file)
index 0000000..7a5fdac
--- /dev/null
+++ b/manifests/docker.pp
@@ -0,0 +1,28 @@
+# See http://serverfault.com/questions/579726/docker-shorewall
+class firewall::docker($device) {
+  class { 'firewall::forwarding': }
+
+  shorewall::masq { "${device}":
+    interface => "${device}",
+    source    => '172.17.0.0/16',
+    order     => '10',
+  }
+
+  shorewall::zone { 'dock':
+    type  => 'ipv4',
+    order => '10',
+  }
+
+  shorewall::policy { 'dock-all':
+    sourcezone      => 'dock',
+    destinationzone => 'all',
+    policy          => 'ACCEPT',
+    order           => 10,
+  }
+
+  shorewall::interface { 'docker0': 
+   zone    => 'dock',
+   rfc1918 => false,
+   options => 'tcpflags,blacklist,routefilter,nosmurfs,logmartians',
+  }
+}

diff --git a/manifests/forwarding.pp b/manifests/forwarding.pp
new file mode 100644 (file)
index 0000000..603fcc6
--- /dev/null
+++ b/manifests/forwarding.pp
@@ -0,0 +1,8 @@
+class firewall::forwarding {
+  augeas { 'ip_forwarding':
+    changes => 'set /files/etc/shorewall/shorewall.conf/IP_FORWARDING On',
+    lens    => 'Shellvars.lns',
+    incl    => '/etc/shorewall/shorewall.conf',
+    notify  => Service[shorewall];
+  }
+}