updated leap_ca_daemon config file, deploying x509 cert+key

4 files changed, 49 insertions, 9 deletions

diff --git a/puppet/modules/site_ca_daemon/manifests/couchdb.pp b/puppet/modules/site_ca_daemon/manifests/couchdb.pp
index b5a1d2d4..f446a05b 100644
--- a/puppet/modules/site_ca_daemon/manifests/couchdb.pp
+++ b/puppet/modules/site_ca_daemon/manifests/couchdb.pp
@@ -6,8 +6,8 @@ class site_ca_daemon::couchdb {
   $couchdb_password = $ca['couchdb_user']['password']
 
   file {
-    '/srv/leap_ca_daemon/config/couchdb.yml':
-      content => template('site_ca_daemon/couchdb.yml.erb'),
+    '/etc/leap/leap_ca.yaml':
+      content => template('site_ca_daemon/leap_ca.yaml.erb'),
       owner   => leap_ca_daemon,
       group   => leap_ca_daemon,
       mode    => '0600';
diff --git a/puppet/modules/site_ca_daemon/manifests/init.pp b/puppet/modules/site_ca_daemon/manifests/init.pp
index 0bbc9030..aa9219c1 100644
--- a/puppet/modules/site_ca_daemon/manifests/init.pp
+++ b/puppet/modules/site_ca_daemon/manifests/init.pp
@@ -3,6 +3,7 @@ class site_ca_daemon {
   #$definition_files = hiera('definition_files')
   #$provider         = $definition_files['provider']
   #$eip_service      = $definition_files['eip_service']
+  $x509             = hiera('x509') 
 
   Class[Ruby] -> Class[rubygems] -> Class[bundler::install]
 
@@ -27,6 +28,19 @@ class site_ca_daemon {
     require   => [ Group['leap_ca_daemon'] ];
   }
 
+
+  x509::key {                                                                   
+    'leap_ca_daemon':                                                           
+      content => $x509['cert'],                                               
+      #notify  => Service[apache];                                               
+  }                                                                             
+                                                                                
+  x509::cert {                                                                  
+    'leap_ca_daemon':                                                           
+      content => $x509['key'],                                              
+      #notify  => Service[apache];                                               
+  }    
+
   file { '/srv/leap_ca_daemon':
     ensure  => directory,
     owner   => 'leap_ca_daemon',
@@ -52,4 +66,6 @@ class site_ca_daemon {
     require => [ Class['bundler::install'], Vcsrepo['/srv/leap_ca_daemon'] ];
   }
 
+
+
 }
diff --git a/puppet/modules/site_ca_daemon/templates/couchdb.yml.erb b/puppet/modules/site_ca_daemon/templates/couchdb.yml.erb
deleted file mode 100644
index f5132599..00000000
--- a/puppet/modules/site_ca_daemon/templates/couchdb.yml.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-production:
-  protocol: 'https'
-  host: <%= couchdb_host %>
-  port: 443
-  username: <%= couchdb_user %>
-  password: <%= couchdb_password %>
-
diff --git a/puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb b/puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb
new file mode 100644
index 00000000..e0b95278
--- /dev/null
+++ b/puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb
@@ -0,0 +1,31 @@
+#
+# Default configuration options for LEAP Certificate Authority Daemon
+#
+
+#
+# Certificate Authority
+#
+ca_key_path: "/etc/x509/keys/leap_ca_daemon.key"
+ca_key_password: nil
+ca_cert_path: "/etc/x509/certs/leap_ca_daemon.crt"
+
+#
+# Certificate pool
+#
+max_pool_size: 100
+client_cert_lifespan: 2
+client_cert_bit_size: 2024
+client_cert_hash: "SHA256"
+
+#
+# Database
+#
+db_name: "client_certificates"
+couch_connection:
+  protocol: "https"
+  host: <%= couchdb_host %>
+  port: 6984 
+  username: <%= couchdb_user %>
+  password: <%= couchdb_password %>
+  prefix: ""
+  suffix: ""