summaryrefslogtreecommitdiff
path: root/puppet/modules/site_openvpn
diff options
context:
space:
mode:
authorvarac <varacanero@zeromail.org>2013-09-20 18:58:29 +0200
committervarac <varacanero@zeromail.org>2013-09-20 18:58:29 +0200
commit0bf2c2eeaf5f8b683454ce0d0dbe88bb6f17c08f (patch)
treea5252934c67cb2316e8d7163c5170f58e3f51491 /puppet/modules/site_openvpn
parente182d12c72743491805a3873e8b6cd804fe5394c (diff)
parent486a9cd3b7bd8d643a9623fd40db2286cdf52fc8 (diff)
Merge branch 'feature/3832_Unify_x509_certs__keys_and_ca' into develop
Diffstat (limited to 'puppet/modules/site_openvpn')
-rw-r--r--puppet/modules/site_openvpn/manifests/dh_key.pp10
-rw-r--r--puppet/modules/site_openvpn/manifests/init.pp17
-rw-r--r--puppet/modules/site_openvpn/manifests/keys.pp45
3 files changed, 22 insertions, 50 deletions
diff --git a/puppet/modules/site_openvpn/manifests/dh_key.pp b/puppet/modules/site_openvpn/manifests/dh_key.pp
new file mode 100644
index 00000000..13cc0f5b
--- /dev/null
+++ b/puppet/modules/site_openvpn/manifests/dh_key.pp
@@ -0,0 +1,10 @@
+class site_openvpn::dh_key {
+
+ $x509_config = hiera('x509')
+
+ file { '/etc/openvpn/keys/dh.pem':
+ content => $x509_config['dh'],
+ mode => '0644',
+ }
+
+}
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index fe5ef87f..6ab0d430 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -20,10 +20,13 @@
class site_openvpn {
tag 'leap_service'
+ include site_config::x509::cert_key
+ include site_config::x509::ca_bundle
+
+
Class['site_config::default'] -> Class['site_openvpn']
-
+
$openvpn_config = hiera('openvpn')
- $x509_config = hiera('x509')
$openvpn_ports = $openvpn_config['ports']
if $::ec2_instance_id {
@@ -58,8 +61,8 @@ class site_openvpn {
$openvpn_limited_udp_cidr = '21'
}
- # deploy ca + server keys
- include site_openvpn::keys
+ # deploy dh keys
+ include site_openvpn::dh_key
if $openvpn_allow_unlimited and $openvpn_allow_limited {
$unlimited_gateway_address = $openvpn_gateway_address
@@ -134,7 +137,11 @@ class site_openvpn {
command => '/etc/init.d/openvpn restart',
refreshonly => true,
subscribe => File['/etc/openvpn'],
- require => [ Package['openvpn'], File['/etc/openvpn'] ];
+ require => [
+ Package['openvpn'],
+ File['/etc/openvpn'],
+ Class['Site_config::X509::Cert_key'],
+ Class['Site_config::X509::Ca_bundle'] ];
}
cron { 'add_gateway_ips.sh':
diff --git a/puppet/modules/site_openvpn/manifests/keys.pp b/puppet/modules/site_openvpn/manifests/keys.pp
deleted file mode 100644
index 864bbd9b..00000000
--- a/puppet/modules/site_openvpn/manifests/keys.pp
+++ /dev/null
@@ -1,45 +0,0 @@
-class site_openvpn::keys {
-
- x509::key {
- 'leap_openvpn':
- content => $site_openvpn::x509_config['key'],
- notify => Service[openvpn];
- }
-
- x509::cert {
- 'leap_openvpn':
- content => $site_openvpn::x509_config['cert'],
- notify => Service[openvpn];
- }
-
- file { '/etc/openvpn/keys/dh.pem':
- content => $site_openvpn::x509_config['dh'],
- mode => '0644',
- }
-
- #
- # CA bundle -- we want to have the possibility of allowing multiple CAs.
- # For now, the reason is to transition to using client CA. In the future,
- # we will want to be able to smoothly phase out one CA and phase in another.
- # I tried "--capath" for this, but it did not work.
- #
-
- concat {
- '/etc/openvpn/ca_bundle.pem':
- owner => root,
- group => root,
- mode => 644,
- warn => true,
- notify => Service['openvpn'];
- }
-
- concat::fragment {
- 'client_ca_cert':
- content => $site_openvpn::x509_config['client_ca_cert'],
- target => '/etc/openvpn/ca_bundle.pem';
- 'ca_cert':
- content => $site_openvpn::x509_config['ca_cert'],
- target => '/etc/openvpn/ca_bundle.pem';
- }
-
-}