2 files changed, 73 insertions, 6 deletions
diff --git a/provider_base/common.json b/provider_base/common.json
index e9531eee..622bca38 100644
--- a/provider_base/common.json
+++ b/provider_base/common.json
@@ -29,12 +29,7 @@
   "x509": {
     "use": true,
     "use_commercial": false,
-    "cert": "= x509.use ? file(:node_x509_cert, :missing => 'x509 certificate for node $node. Run `leap cert update`') : nil",
-    "key": "= x509.use ? file(:node_x509_key, :missing => 'x509 key for node $node. Run `leap cert update`') : nil",
-    "ca_cert": "= try_file :ca_cert",
-    "commercial_cert": "= x509.use_commercial ? file([:commercial_cert, try{webapp.domain}||domain.full_suffix], :missing => 'commercial x509 certificate for node $node. Add file $file, or run `leap cert csr --domain %s` to generate a temporary self-signed cert and CSR you can use to purchase a real cert.' % (try{webapp.domain}||domain.full_suffix)) : nil",
-    "commercial_key": "= x509.use_commercial ? file([:commercial_key, try{webapp.domain}||domain.full_suffix], :missing => 'commercial x509 certificate for node $node. Add file $file, or run `leap cert csr --domain %s` to generate a temporary self-signed cert and CSR you can use to purchase a real cert.' % (try{webapp.domain}||domain.full_suffix)) : nil",
-    "commercial_ca_cert": "= x509.use_commercial ? try_file(:commercial_ca_cert) : nil"
+    "ca_cert": "= try_file :ca_cert"
   },
   "service_type": "internal_service",
   "development": {
diff --git a/provider_base/common.rb b/provider_base/common.rb
new file mode 100644
index 00000000..a8cc6717
--- /dev/null
+++ b/provider_base/common.rb
@@ -0,0 +1,72 @@
+##
+## common.rb -- evaluated (last) for every node.
+##
+## Because common.rb is evaluated last, it is good practice to only modify
+## values here if they are empty. This gives a chance for tags and services
+## to set values.
+##
+
+#
+# X509 server certificates that use our own CA
+#
+
+if self['x509.use']
+  if self['x509.cert'].nil?
+    self.set('x509.cert', lambda{file(
+      :node_x509_cert,
+      :missing => "x509 certificate for node $node. Run `leap cert update` to generate it."
+    )})
+  end
+  if self['x509.key'].nil?
+    self.set('x509.key', lambda{file(
+     :node_x509_key,
+      :missing => "x509 key for node $node. Run `leap cert update` to generate it."
+    )})
+  end
+else
+  self.set('x509.cert', nil)
+  self.set('x509.key', nil)
+end
+
+#
+# X509 server certificates that use an external CA
+#
+
+if self['x509.use_commercial']
+  domain = self['webapp.domain'] || self['domain.full_suffix']
+  if self['x509.commercial_cert'].nil?
+    self.set('x509.commercial_cert', lambda{file(
+      [:commercial_cert, domain],
+      :missing => "commercial x509 certificate for node `$node`. " +
+        "Add file $file, or run `leap cert csr %s`." % domain
+    )})
+  end
+  if self['x509.commercial_key'].nil?
+    self.set('x509.commercial_key', lambda{file(
+      [:commercial_key, domain],
+      :missing => "commercial x509 key for node `$node`. " +
+        "Add file $file, or run `leap cert csr %s`" % domain
+    )})
+  end
+
+  #
+  # the content of x509.commercial_cert might include the cert
+  # and the full CA chain, or it might just be the cert only.
+  #
+  # if it is the cert only, then we want to additionally specify
+  # 'commercial_ca_cert'. Otherwise, we leave this empty.
+  #
+  if self['x509.commercial_ca_cert'].nil?
+    self.set('x509.commercial_ca_cert', lambda{
+      if self['x509.commercial_cert'].scan(/BEGIN CERTIFICATE/).length == 1
+        try_file(:commercial_ca_cert)
+      else
+        nil
+      end
+    })
+  end
+else
+  self.set('x509.commercial_cert', nil)
+  self.set('x509.commercial_key', nil)
+  self.set('x509.commercial_ca_cert', nil)
+end