Puppet Class: certs::apache

Inherits:
certs
Defined in:
manifests/apache.pp

Overview

Certs configurations for Apache

Parameters:

$hostname

The fqdn of the host the generated certificates should be for

$cname

The alternative names of the host the generated certificates should be for

$server_cert

Path to the ssl certificate for https if not specified, the default CA will generate one

$server_key

Path to the ssl key for https if not specified, the default CA will generate one

$server_cert_req

Path to the ssl certificate request for https if not specified, the default CA will generate one

Advanced parameters:

$generate

Should the generation of the certs be part of the configuration

$regenerate

Force regeneration of the certificates (excluding CA certificates)

$deploy

Deploy the certs on the configured system. False means we want to apply it to a different system

$country

Country attribute for managed certificates

$state

State attribute for managed certificates

$city

City attribute for managed certificates

$org

Org attribute for managed certificates

$org_unit

Org unit attribute for managed certificates

$expiration

Expiration attribute for managed certificates

$pki_dir

The PKI directory under which to place certs

$group

The group who should own the certs

$ca_key_password_file

Location of the password file for the CA key

Parameters:

  • hostname (Stdlib::Fqdn) (defaults to: $certs::node_fqdn)
  • cname (Array[Stdlib::Fqdn]) (defaults to: $certs::cname)
  • generate (Boolean) (defaults to: $certs::generate)
  • regenerate (Boolean) (defaults to: $certs::regenerate)
  • deploy (Boolean) (defaults to: $certs::deploy)
  • pki_dir (Stdlib::Absolutepath) (defaults to: $certs::pki_dir)
  • server_cert (Optional[Stdlib::Absolutepath]) (defaults to: $certs::server_cert)
  • server_key (Optional[Stdlib::Absolutepath]) (defaults to: $certs::server_key)
  • server_cert_req (Optional[Stdlib::Absolutepath]) (defaults to: $certs::server_cert_req)
  • country (String[2,2]) (defaults to: $certs::country)
  • state (String) (defaults to: $certs::state)
  • city (String) (defaults to: $certs::city)
  • org (String) (defaults to: $certs::org)
  • org_unit (String) (defaults to: $certs::org_unit)
  • expiration (String) (defaults to: $certs::expiration)
  • ca_key_password_file (Stdlib::Absolutepath) (defaults to: $certs::ca_key_password_file)
  • group (String) (defaults to: $certs::group) 


48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
 
# File 'manifests/apache.pp', line 48

class certs::apache (
  Stdlib::Fqdn $hostname = $certs::node_fqdn,
  Array[Stdlib::Fqdn] $cname = $certs::cname,
  Boolean $generate = $certs::generate,
  Boolean $regenerate = $certs::regenerate,
  Boolean $deploy = $certs::deploy,
  Stdlib::Absolutepath $pki_dir = $certs::pki_dir,
  Optional[Stdlib::Absolutepath] $server_cert = $certs::server_cert,
  Optional[Stdlib::Absolutepath] $server_key = $certs::server_key,
  Optional[Stdlib::Absolutepath] $server_cert_req = $certs::server_cert_req,
  String[2,2] $country = $certs::country,
  String $state = $certs::state,
  String $city = $certs::city,
  String $org = $certs::org,
  String $org_unit = $certs::org_unit,
  String $expiration = $certs::expiration,
  Stdlib::Absolutepath $ca_key_password_file = $certs::ca_key_password_file,
  String $group = $certs::group,
) inherits certs {
  $apache_cert_name = "${hostname}-apache"
  $apache_cert = "${pki_dir}/certs/katello-apache.crt"
  $apache_key  = "${pki_dir}/private/katello-apache.key"
  # This variable is unused but considered public API
  $apache_ca_cert = $certs::katello_server_ca_cert

  if $server_cert {
    cert { $apache_cert_name:
      ensure         => present,
      hostname       => $hostname,
      cname          => $cname,
      generate       => $generate,
      deploy         => false,
      regenerate     => $regenerate,
      custom_pubkey  => $server_cert,
      custom_privkey => $server_key,
      custom_req     => $server_cert_req,
      build_dir      => $certs::ssl_build_dir,
    }
  } else {
    cert { $apache_cert_name:
      ensure        => present,
      hostname      => $hostname,
      cname         => $cname,
      country       => $country,
      state         => $state,
      city          => $city,
      org           => $org,
      org_unit      => $org_unit,
      expiration    => $expiration,
      ca            => $certs::default_ca,
      generate      => $generate,
      regenerate    => $regenerate,
      deploy        => false,
      password_file => $ca_key_password_file,
      build_dir     => $certs::ssl_build_dir,
    }
  }

  if $deploy {
    certs::keypair { $apache_cert_name:
      source_dir => "${certs::ssl_build_dir}/${hostname}",
      key_file   => $apache_key,
      key_owner  => 'root',
      key_group  => $group,
      key_mode   => '0440',
      cert_file  => $apache_cert,
      cert_owner => 'root',
      cert_group => $group,
      cert_mode  => '0440',
      require    => Cert[$apache_cert_name],
    }
  }
}