4 files changed, 26 insertions, 58 deletions
diff --git a/puppet/modules/site_openvpn/manifests/dh_key.pp b/puppet/modules/site_openvpn/manifests/dh_key.pp
new file mode 100644
index 00000000..13cc0f5b
--- /dev/null
+++ b/puppet/modules/site_openvpn/manifests/dh_key.pp
@@ -0,0 +1,10 @@
+class site_openvpn::dh_key {
+
+  $x509_config      = hiera('x509')
+
+  file { '/etc/openvpn/keys/dh.pem':
+    content => $x509_config['dh'],
+    mode    => '0644',
+  }
+
+}
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index b2bb0d3a..6ab0d430 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -20,8 +20,13 @@
 class site_openvpn {
   tag 'leap_service'
 
+  include site_config::x509::cert_key
+  include site_config::x509::ca_bundle
+
+
+  Class['site_config::default'] -> Class['site_openvpn']
+
   $openvpn_config   = hiera('openvpn')
-  $x509_config      = hiera('x509')
   $openvpn_ports    = $openvpn_config['ports']
 
   if $::ec2_instance_id {
@@ -56,8 +61,8 @@ class site_openvpn {
     $openvpn_limited_udp_cidr             = '21'
   }
 
-  # deploy ca + server keys
-  include site_openvpn::keys
+  # deploy dh keys
+  include site_openvpn::dh_key
 
   if $openvpn_allow_unlimited and $openvpn_allow_limited {
     $unlimited_gateway_address = $openvpn_gateway_address
@@ -132,7 +137,11 @@ class site_openvpn {
     command     => '/etc/init.d/openvpn restart',
     refreshonly => true,
     subscribe   => File['/etc/openvpn'],
-    require     => [ Package['openvpn'], File['/etc/openvpn'] ];
+    require     => [
+      Package['openvpn'],
+      File['/etc/openvpn'],
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca_bundle'] ];
   }
 
   cron { 'add_gateway_ips.sh':
diff --git a/puppet/modules/site_openvpn/manifests/keys.pp b/puppet/modules/site_openvpn/manifests/keys.pp
deleted file mode 100644
index f3c5b423..00000000
--- a/puppet/modules/site_openvpn/manifests/keys.pp
+++ /dev/null
@@ -1,51 +0,0 @@
-class site_openvpn::keys {
-
-  x509::key {
-    'leap_openvpn':
-      content => $site_openvpn::x509_config['key'],
-      notify  => Service[openvpn];
-  }
-
-  x509::cert {
-    'leap_openvpn':
-      content => $site_openvpn::x509_config['cert'],
-      notify  => Service[openvpn];
-  }
-
-  x509::ca {
-    'leap_ca':
-      content => $site_openvpn::x509_config['ca_cert'],
-      notify  => Service[openvpn];
-  }
-
-  file { '/etc/openvpn/keys/dh.pem':
-    content => $site_openvpn::x509_config['dh'],
-    mode    => '0644',
-  }
-
-  #
-  # CA bundle -- we want to have the possibility of allowing multiple CAs.
-  # For now, the reason is to transition to using client CA. In the future,
-  # we will want to be able to smoothly phase out one CA and phase in another.
-  # I tried "--capath" for this, but it did not work.
-  #
-
-  concat {
-    '/etc/openvpn/ca_bundle.pem':
-      owner  => root,
-      group  => root,
-      mode   => 644,
-      warn   => true,
-      notify => Service['openvpn'];
-  }
-
-  concat::fragment {
-    'client_ca_cert':
-      content => $site_openvpn::x509_config['client_ca_cert'],
-      target  => '/etc/openvpn/ca_bundle.pem';
-    'ca_cert':
-      content => $site_openvpn::x509_config['ca_cert'],
-      target  => '/etc/openvpn/ca_bundle.pem';
-  }
-
-}
diff --git a/puppet/modules/site_openvpn/manifests/server_config.pp b/puppet/modules/site_openvpn/manifests/server_config.pp
index 5ba9812f..befeaef7 100644
--- a/puppet/modules/site_openvpn/manifests/server_config.pp
+++ b/puppet/modules/site_openvpn/manifests/server_config.pp
@@ -80,15 +80,15 @@ define site_openvpn::server_config(
   openvpn::option {
     "ca ${openvpn_configname}":
         key     => 'ca',
-        value   => '/etc/openvpn/ca_bundle.pem',
+        value   => "${x509::variables::local_CAs}/${site_config::params::ca_bundle_name}.crt",
         server  => $openvpn_configname;
     "cert ${openvpn_configname}":
         key     => 'cert',
-        value   => '/etc/x509/certs/leap_openvpn.crt',
+        value   => "${x509::variables::certs}/${site_config::params::cert_name}.crt",
         server  => $openvpn_configname;
     "key ${openvpn_configname}":
         key     => 'key',
-        value   => '/etc/x509/keys/leap_openvpn.key',
+        value   => "${x509::variables::keys}/${site_config::params::cert_name}.key",
         server  => $openvpn_configname;
     "dh ${openvpn_configname}":
         key     => 'dh',