summaryrefslogtreecommitdiff
path: root/puppet/modules/site_config/manifests
diff options
context:
space:
mode:
authorvarac <varacanero@zeromail.org>2013-09-20 18:58:29 +0200
committervarac <varacanero@zeromail.org>2013-09-20 18:58:29 +0200
commit0bf2c2eeaf5f8b683454ce0d0dbe88bb6f17c08f (patch)
treea5252934c67cb2316e8d7163c5170f58e3f51491 /puppet/modules/site_config/manifests
parente182d12c72743491805a3873e8b6cd804fe5394c (diff)
parent486a9cd3b7bd8d643a9623fd40db2286cdf52fc8 (diff)
Merge branch 'feature/3832_Unify_x509_certs__keys_and_ca' into develop
Diffstat (limited to 'puppet/modules/site_config/manifests')
-rw-r--r--puppet/modules/site_config/manifests/default.pp2
-rw-r--r--puppet/modules/site_config/manifests/x509.pp28
-rw-r--r--puppet/modules/site_config/manifests/x509/ca.pp9
-rw-r--r--puppet/modules/site_config/manifests/x509/ca_bundle.pp16
-rw-r--r--puppet/modules/site_config/manifests/x509/cert_key.pp15
-rw-r--r--puppet/modules/site_config/manifests/x509/client_ca.pp14
6 files changed, 54 insertions, 30 deletions
diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 83a344a2..b27e99af 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -62,6 +62,4 @@ class site_config::default {
include site_squid_deb_proxy::client
}
- include site_config::x509
-
}
diff --git a/puppet/modules/site_config/manifests/x509.pp b/puppet/modules/site_config/manifests/x509.pp
deleted file mode 100644
index 8eca97e7..00000000
--- a/puppet/modules/site_config/manifests/x509.pp
+++ /dev/null
@@ -1,28 +0,0 @@
-class site_config::x509 {
-
- $x509 = hiera('x509')
- $key = $x509['key']
- $cert = $x509['cert']
- $ca = $x509['ca_cert']
- $client_ca = $x509['client_ca_cert']
-
- x509::key { $site_config::params::cert_name:
- content => $key
- }
-
- x509::cert { $site_config::params::cert_name:
- content => $cert
- }
-
- x509::ca { $site_config::params::ca_name:
- content => $ca
- }
-
- x509::ca { $site_config::params::client_ca_name:
- content => $client_ca
- }
-
- x509::ca { $site_config::params::ca_bundle_name:
- content => "${ca}${client_ca}"
- }
-}
diff --git a/puppet/modules/site_config/manifests/x509/ca.pp b/puppet/modules/site_config/manifests/x509/ca.pp
new file mode 100644
index 00000000..b16d0eeb
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/ca.pp
@@ -0,0 +1,9 @@
+class site_config::x509::ca {
+
+ $x509 = hiera('x509')
+ $ca = $x509['ca_cert']
+
+ x509::ca { $site_config::params::ca_name:
+ content => $ca
+ }
+}
diff --git a/puppet/modules/site_config/manifests/x509/ca_bundle.pp b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
new file mode 100644
index 00000000..4cbe574a
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
@@ -0,0 +1,16 @@
+class site_config::x509::ca_bundle {
+
+ # CA bundle -- we want to have the possibility of allowing multiple CAs.
+ # For now, the reason is to transition to using client CA. In the future,
+ # we will want to be able to smoothly phase out one CA and phase in another.
+ # I tried "--capath" for this, but it did not work.
+
+
+ $x509 = hiera('x509')
+ $ca = $x509['ca_cert']
+ $client_ca = $x509['client_ca_cert']
+
+ x509::ca { $site_config::params::ca_bundle_name:
+ content => "${ca}${client_ca}"
+ }
+}
diff --git a/puppet/modules/site_config/manifests/x509/cert_key.pp b/puppet/modules/site_config/manifests/x509/cert_key.pp
new file mode 100644
index 00000000..d55c6cf2
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/cert_key.pp
@@ -0,0 +1,15 @@
+class site_config::x509::cert_key {
+
+ $x509 = hiera('x509')
+ $key = $x509['key']
+ $cert = $x509['cert']
+
+ x509::key { $site_config::params::cert_name:
+ content => $key
+ }
+
+ x509::cert { $site_config::params::cert_name:
+ content => $cert
+ }
+
+}
diff --git a/puppet/modules/site_config/manifests/x509/client_ca.pp b/puppet/modules/site_config/manifests/x509/client_ca.pp
new file mode 100644
index 00000000..3e914cf5
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/client_ca.pp
@@ -0,0 +1,14 @@
+class site_config::x509::client_ca {
+
+ ##
+ ## This is for the special CA that is used exclusively for generating
+ ## client certificates by the webapp.
+ ##
+
+ $x509 = hiera('x509')
+ $client_ca = $x509['client_ca_cert']
+
+ x509::ca { $site_config::params::client_ca_name:
+ content => $client_ca
+ }
+}