summaryrefslogtreecommitdiff
diff options
context:
space:
mode:
-rw-r--r--puppet/modules/site_webapp/manifests/couchdb.pp9
-rw-r--r--puppet/modules/site_webapp/manifests/couchdb_stunnel.pp42
-rw-r--r--puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp17
3 files changed, 68 insertions, 0 deletions
diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index 6cac666f..26de62ee 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -1,5 +1,9 @@
class site_webapp::couchdb {
+ $x509 = hiera('x509')
+ $key = $x509['key']
+ $cert = $x509['cert']
+ $ca = $x509['ca_cert']
$webapp = hiera('webapp')
$couchdb_host = $webapp['couchdb_hosts']
$couchdb_user = $webapp['couchdb_user']['username']
@@ -13,4 +17,9 @@ class site_webapp::couchdb {
mode => '0600';
}
+ class { 'site_webapp::couchdb_stunnel':
+ key => $key,
+ cert => $cert,
+ ca => $ca
+ }
}
diff --git a/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp b/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp
new file mode 100644
index 00000000..e6657e13
--- /dev/null
+++ b/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp
@@ -0,0 +1,42 @@
+class site_webapp::couchdb_stunnel ($key, $cert, $ca) {
+
+ include x509::variables
+ include site_stunnel
+
+ $cert_name = 'leap_couchdb'
+ $ca_path = "${x509::variables::certs}/leap_client_ca.crt"
+ $cert_path = "${x509::variables::certs}/${cert_name}.crt"
+ $key_path = "${x509::variables::keys}/${cert_name}.key"
+
+ x509::key {
+ $cert_name:
+ content => $key,
+ notify => Service['stunnel'];
+ }
+
+ x509::cert {
+ $cert_name:
+ content => $cert,
+ notify => Service['stunnel'];
+ }
+
+ x509::ca {
+ $cert_name:
+ content => $ca,
+ notify => Service['stunnel'];
+ }
+
+ $couchdb_stunnel_client_defaults = {
+ 'client' => true,
+ 'cafile' => $ca_path,
+ 'key' => $key_path,
+ 'cert' => $cert_path,
+ 'verify' => '2',
+ 'rndfile' => '/var/lib/stunnel4/.rnd',
+ 'debuglevel' => '4'
+ }
+
+ create_resources(site_webapp::couchdb_stunnel::clients, hiera('stunnel'), $couchdb_stunnel_client_defaults)
+
+}
+
diff --git a/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp b/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp
new file mode 100644
index 00000000..eac43b08
--- /dev/null
+++ b/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp
@@ -0,0 +1,17 @@
+define site_webapp::couchdb_stunnel::clients
+ ( $accept_port, $connect, $client, $cafile, $key, $cert,
+ $verify, $pid = $name, $rndfile, $debuglevel ) {
+
+ stunnel::service { $name:
+ accept => "127.0.0.1:${accept_port}",
+ connect => "${connect}:6984",
+ client => $client,
+ cafile => $cafile,
+ key => $key,
+ cert => $cert,
+ verify => $verify,
+ pid => "/var/run/stunnel4/${pid}.pid",
+ rndfile => $rndfile,
+ debuglevel => $debuglevel
+ }
+ }