add couchdb stunnel clients

3 files changed, 68 insertions, 0 deletions

diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index 6cac666f..26de62ee 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -1,5 +1,9 @@
 class site_webapp::couchdb {
 
+  $x509             = hiera('x509')
+  $key              = $x509['key']
+  $cert             = $x509['cert']
+  $ca               = $x509['ca_cert']
   $webapp           = hiera('webapp')
   $couchdb_host     = $webapp['couchdb_hosts']
   $couchdb_user     = $webapp['couchdb_user']['username']
@@ -13,4 +17,9 @@ class site_webapp::couchdb {
       mode    => '0600';
   }
 
+  class { 'site_webapp::couchdb_stunnel':
+    key  => $key,
+    cert => $cert,
+    ca   => $ca
+  }
 }
diff --git a/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp b/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp
new file mode 100644
index 00000000..e6657e13
--- /dev/null
+++ b/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp
@@ -0,0 +1,42 @@
+class site_webapp::couchdb_stunnel ($key, $cert, $ca) {
+
+  include x509::variables
+  include site_stunnel
+
+  $cert_name = 'leap_couchdb'
+  $ca_path = "${x509::variables::certs}/leap_client_ca.crt"
+  $cert_path = "${x509::variables::certs}/${cert_name}.crt"
+  $key_path = "${x509::variables::keys}/${cert_name}.key"
+
+  x509::key {
+    $cert_name:
+      content => $key,
+      notify  => Service['stunnel'];
+  }
+
+  x509::cert {
+    $cert_name:
+      content => $cert,
+      notify  => Service['stunnel'];
+  }
+
+  x509::ca {
+    $cert_name:
+      content => $ca,
+      notify => Service['stunnel'];
+  }
+
+  $couchdb_stunnel_client_defaults = {
+    'client'     => true,
+    'cafile'     => $ca_path,
+    'key'        => $key_path,
+    'cert'       => $cert_path,
+    'verify'     => '2',
+    'rndfile'    => '/var/lib/stunnel4/.rnd',
+    'debuglevel' => '4'
+  }
+
+  create_resources(site_webapp::couchdb_stunnel::clients, hiera('stunnel'), $couchdb_stunnel_client_defaults)
+
+}
+
diff --git a/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp b/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp
new file mode 100644
index 00000000..eac43b08
--- /dev/null
+++ b/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp
@@ -0,0 +1,17 @@
+define site_webapp::couchdb_stunnel::clients
+    ( $accept_port, $connect, $client, $cafile, $key, $cert,
+      $verify, $pid = $name, $rndfile, $debuglevel ) {
+
+    stunnel::service { $name:
+      accept     => "127.0.0.1:${accept_port}",
+      connect    => "${connect}:6984",
+      client     => $client,
+      cafile     => $cafile,
+      key        => $key,
+      cert       => $cert,
+      verify     => $verify,
+      pid        => "/var/run/stunnel4/${pid}.pid",
+      rndfile    => $rndfile,
+      debuglevel => $debuglevel
+    }
+  }