Merge branch 'feature/3832_Unify_x509_certs__keys_and_ca' into develop

5 files changed, 17 insertions, 56 deletions

diff --git a/puppet/modules/site_webapp/manifests/apache.pp b/puppet/modules/site_webapp/manifests/apache.pp
index 4331afe4..3dd1c4c7 100644
--- a/puppet/modules/site_webapp/manifests/apache.pp
+++ b/puppet/modules/site_webapp/manifests/apache.pp
@@ -8,9 +8,15 @@ class site_webapp::apache {
   $commercial_key   = $x509['commercial_key']
   $commercial_cert  = $x509['commercial_cert']
   $commercial_root  = $x509['commercial_ca_cert']
-  $api_key          = $x509['key']
-  $api_cert         = $x509['cert']
-  $api_root         = $x509['ca_cert']
+
+  include site_config::x509::cert_key
+  include site_config::x509::ca
+
+  include x509::variables
+
+  X509::Cert[$site_config::params::cert_name] ~> Service[apache]
+  X509::Key[$site_config::params::cert_name]  ~> Service[apache]
+  X509::Ca[$site_config::params::ca_name]  ~> Service[apache]
 
   class { '::apache': no_default_site => true, ssl => true }
 
@@ -34,29 +40,17 @@ class site_webapp::apache {
     'leap_webapp':
       content => $commercial_key,
       notify  => Service[apache];
-
-    'leap_api':
-      content => $api_key,
-      notify  => Service[apache];
   }
 
   x509::cert {
     'leap_webapp':
       content => $commercial_cert,
       notify  => Service[apache];
-
-    'leap_api':
-      content => $api_cert,
-      notify  => Service[apache];
   }
 
   x509::ca {
     'leap_webapp':
       content => $commercial_root,
       notify  => Service[apache];
-
-    'leap_api':
-      content => $api_root,
-      notify  => Service[apache];
   }
 }
diff --git a/puppet/modules/site_webapp/manifests/client_ca.pp b/puppet/modules/site_webapp/manifests/client_ca.pp
deleted file mode 100644
index 0d9b15d6..00000000
--- a/puppet/modules/site_webapp/manifests/client_ca.pp
+++ /dev/null
@@ -1,25 +0,0 @@
-##
-## This is for the special CA that is used exclusively for generating
-## client certificates by the webapp.
-##
-
-class site_webapp::client_ca {
-  include x509::variables
-
-  $x509 = hiera('x509')
-  $cert_path = "${x509::variables::certs}/leap_client_ca.crt"
-  $key_path = "${x509::variables::keys}/leap_client_ca.key"
-
-  x509::key {
-    'leap_client_ca':
-      source => $x509['client_ca_key'],
-      group  => 'leap-webapp',
-      notify  => Service[apache];
-  }
-
-  x509::cert {
-    'leap_client_ca':
-      source => $x509['client_ca_cert'],
-      notify  => Service[apache];
-  }
-}
diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index f9a4eb6b..5a5cccad 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -14,15 +14,6 @@ class site_webapp::couchdb {
   $couch_client_connect    = $couch_client['connect']
 
   include x509::variables
-  $x509                    = hiera('x509')
-  $key                     = $x509['key']
-  $cert                    = $x509['cert']
-  $ca                      = $x509['ca_cert']
-  $cert_name               = 'leap_couchdb'
-  $ca_name                 = 'leap_ca'
-  $ca_path                 = "${x509::variables::local_CAs}/${ca_name}.crt"
-  $cert_path               = "${x509::variables::certs}/${cert_name}.crt"
-  $key_path                = "${x509::variables::keys}/${cert_name}.key"
 
   file {
     '/srv/leap/webapp/config/couchdb.yml.admin':
@@ -71,10 +62,10 @@ class site_webapp::couchdb {
 
   $couchdb_stunnel_client_defaults = {
     'connect_port' => $couch_client_connect,
-    'client'     => true,
-    'cafile'     => $ca_path,
-    'key'        => $key_path,
-    'cert'       => $cert_path,
+    'client'       => true,
+    'cafile'       => "${x509::variables::local_CAs}/${site_config::params::ca_name}.crt",
+    'key'          => "${x509::variables::keys}/${site_config::params::cert_name}.key",
+    'cert'         => "${x509::variables::certs}/${site_config::params::cert_name}.crt",
   }
 
   create_resources(site_stunnel::clients, $couch_client, $couchdb_stunnel_client_defaults)
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 97a75010..4b06cea6 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -16,8 +16,9 @@ class site_webapp {
   include site_config::ruby
   include site_webapp::apache
   include site_webapp::couchdb
-  include site_webapp::client_ca
   include site_webapp::haproxy
+  include site_config::x509::cert_key
+  include site_config::x509::ca
 
   group { 'leap-webapp':
     ensure    => present,
diff --git a/puppet/modules/site_webapp/templates/config.yml.erb b/puppet/modules/site_webapp/templates/config.yml.erb
index 05d62d41..0ce623fc 100644
--- a/puppet/modules/site_webapp/templates/config.yml.erb
+++ b/puppet/modules/site_webapp/templates/config.yml.erb
@@ -3,8 +3,8 @@ production:
   admins: <%= @webapp['admins'].inspect %>
   domain: <%= @provider_domain %>
   force_ssl: <%= @webapp['secure'] %>
-  client_ca_key: <%= scope.lookupvar('site_webapp::client_ca::key_path') %>
-  client_ca_cert: <%= scope.lookupvar('site_webapp::client_ca::cert_path') %>
+  client_ca_key: <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
+  client_ca_cert: <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
   secret_token: "<%= @secret_token %>"
   client_cert_lifespan: <%= cert_options['life_span'].to_i %>
   client_cert_bit_size: <%= cert_options['bit_size'].to_i %>