#
# Cookbook:: irrigate-haproxy
# Recipe:: config
#
# Author:: Russell de Moose (<rdemoose@theorchard.com>)
# Copyright:: (C) 2016 The Orchard
#

# Change SELinux to permissive until we decide on particular ports
template '/etc/selinux/config' do
  source 'selinux.erb'
  mode '644'
  notifies :reload, 'service[haproxy]', :immediately
end

firewall_rule 'http' do
  port 80
  protocol :tcp
  position 1
  command :allow
end

firewall_rule 'https' do
  port 443
  protocol :tcp
  position 2
  command :allow
end

firewall_rule 'ssh' do
  port 22
  protocol :tcp
  position 3
  command :allow
end

firewall_rule 'web_8080' do
  port 8080
  protocol :tcp
  position 4
  command :allow
end

firewall_rule 'web_8081' do
  port 8081
  protocol :tcp
  position 5
  command :allow
end

firewall_rule 'nrpe' do
  port 5666
  protocol :tcp
  position 6
  command :allow
end

return unless platform_family?('rhel')

if platform_family?('rhel')
  if node['platform_version'].start_with?('6', '7')
    file '/etc/sysctl.d/90-override.conf' do
      action :create
      content 'net.ipv4.ip_nonlocal_bind=1'
      mode '644'
    end
  else
    puts "#{node['platform_version']} is not supported"
  end
end