puppet: Allow tusd to be exposed on non-localhost.

This allows its /metrics endpoint to be monitored.

puppet/kandra/manifests/app_frontend_monitoring.pp

@@ -6,6 +6,7 @@ class kandra::app_frontend_monitoring {
   include kandra::prometheus::uwsgi
   include kandra::prometheus::process
   kandra::firewall_allow { 'grok_exporter': port => '9144' }
+  kandra::firewall_allow { 'tusd': port => '9900' }
 
   file { '/etc/cron.d/rabbitmq-monitoring':
     ensure => absent,

puppet/zulip/manifests/app_frontend_base.pp

@@ -175,6 +175,8 @@ class zulip::app_frontend_base {
   $katex_server = zulipconf('application_server', 'katex_server', true)
   $katex_server_port = zulipconf('application_server', 'katex_server_port', '9700')
 
+  $tusd_server_listen = zulipconf('application_server', 'tusd_server_listen', '127.0.0.1')
+
   if $proxy_host != '' and $proxy_port != '' {
     $proxy = "http://${proxy_host}:${proxy_port}"
   } else {

puppet/zulip/templates/supervisor/zulip.conf.template.erb

@@ -25,7 +25,7 @@ killasgroup=true              ; Without this, we leak processes every restart
 directory=/home/zulip/deployments/current/
 
 [program:zulip-tus]
-command=nice -n5 /home/zulip/deployments/current/manage.py runtusd 9900
+command=nice -n5 /home/zulip/deployments/current/manage.py runtusd <%= @tusd_server_listen %>:9900
 environment=HTTP_proxy="<%= @proxy %>",HTTPS_proxy="<%= @proxy %>"
 priority=100                   ; the relative start priority (default 999)
 autostart=true                 ; start at supervisord start (default: true)