summaryrefslogtreecommitdiff
path: root/puppet
diff options
context:
space:
mode:
authorvarac <varacanero@zeromail.org>2012-12-10 22:54:47 +0100
committervarac <varacanero@zeromail.org>2012-12-10 22:54:47 +0100
commitc8dda5249aa146239dd681db98da2c273dd07d77 (patch)
tree5cde94b15971365f59ad8387b7205fb6434e34ec /puppet
parent62381f11d920a738db6fa673ea29cf4cddd8ebe0 (diff)
updated leap_ca_daemon config file, deploying x509 cert+key
Diffstat (limited to 'puppet')
-rw-r--r--puppet/modules/site_ca_daemon/manifests/couchdb.pp4
-rw-r--r--puppet/modules/site_ca_daemon/manifests/init.pp16
-rw-r--r--puppet/modules/site_ca_daemon/templates/couchdb.yml.erb7
-rw-r--r--puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb31
4 files changed, 49 insertions, 9 deletions
diff --git a/puppet/modules/site_ca_daemon/manifests/couchdb.pp b/puppet/modules/site_ca_daemon/manifests/couchdb.pp
index b5a1d2d4..f446a05b 100644
--- a/puppet/modules/site_ca_daemon/manifests/couchdb.pp
+++ b/puppet/modules/site_ca_daemon/manifests/couchdb.pp
@@ -6,8 +6,8 @@ class site_ca_daemon::couchdb {
$couchdb_password = $ca['couchdb_user']['password']
file {
- '/srv/leap_ca_daemon/config/couchdb.yml':
- content => template('site_ca_daemon/couchdb.yml.erb'),
+ '/etc/leap/leap_ca.yaml':
+ content => template('site_ca_daemon/leap_ca.yaml.erb'),
owner => leap_ca_daemon,
group => leap_ca_daemon,
mode => '0600';
diff --git a/puppet/modules/site_ca_daemon/manifests/init.pp b/puppet/modules/site_ca_daemon/manifests/init.pp
index 0bbc9030..aa9219c1 100644
--- a/puppet/modules/site_ca_daemon/manifests/init.pp
+++ b/puppet/modules/site_ca_daemon/manifests/init.pp
@@ -3,6 +3,7 @@ class site_ca_daemon {
#$definition_files = hiera('definition_files')
#$provider = $definition_files['provider']
#$eip_service = $definition_files['eip_service']
+ $x509 = hiera('x509')
Class[Ruby] -> Class[rubygems] -> Class[bundler::install]
@@ -27,6 +28,19 @@ class site_ca_daemon {
require => [ Group['leap_ca_daemon'] ];
}
+
+ x509::key {
+ 'leap_ca_daemon':
+ content => $x509['cert'],
+ #notify => Service[apache];
+ }
+
+ x509::cert {
+ 'leap_ca_daemon':
+ content => $x509['key'],
+ #notify => Service[apache];
+ }
+
file { '/srv/leap_ca_daemon':
ensure => directory,
owner => 'leap_ca_daemon',
@@ -52,4 +66,6 @@ class site_ca_daemon {
require => [ Class['bundler::install'], Vcsrepo['/srv/leap_ca_daemon'] ];
}
+
+
}
diff --git a/puppet/modules/site_ca_daemon/templates/couchdb.yml.erb b/puppet/modules/site_ca_daemon/templates/couchdb.yml.erb
deleted file mode 100644
index f5132599..00000000
--- a/puppet/modules/site_ca_daemon/templates/couchdb.yml.erb
+++ /dev/null
@@ -1,7 +0,0 @@
-production:
- protocol: 'https'
- host: <%= couchdb_host %>
- port: 443
- username: <%= couchdb_user %>
- password: <%= couchdb_password %>
-
diff --git a/puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb b/puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb
new file mode 100644
index 00000000..e0b95278
--- /dev/null
+++ b/puppet/modules/site_ca_daemon/templates/leap_ca.yaml.erb
@@ -0,0 +1,31 @@
+#
+# Default configuration options for LEAP Certificate Authority Daemon
+#
+
+#
+# Certificate Authority
+#
+ca_key_path: "/etc/x509/keys/leap_ca_daemon.key"
+ca_key_password: nil
+ca_cert_path: "/etc/x509/certs/leap_ca_daemon.crt"
+
+#
+# Certificate pool
+#
+max_pool_size: 100
+client_cert_lifespan: 2
+client_cert_bit_size: 2024
+client_cert_hash: "SHA256"
+
+#
+# Database
+#
+db_name: "client_certificates"
+couch_connection:
+ protocol: "https"
+ host: <%= couchdb_host %>
+ port: 6984
+ username: <%= couchdb_user %>
+ password: <%= couchdb_password %>
+ prefix: ""
+ suffix: ""