summaryrefslogtreecommitdiff
path: root/puppet/modules/site_webapp/manifests
diff options
context:
space:
mode:
Diffstat (limited to 'puppet/modules/site_webapp/manifests')
-rw-r--r--puppet/modules/site_webapp/manifests/couchdb.pp38
-rw-r--r--puppet/modules/site_webapp/manifests/couchdb_stunnel.pp43
-rw-r--r--puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp17
3 files changed, 30 insertions, 68 deletions
diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index ef61aeb6..e956fd54 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -1,9 +1,5 @@
class site_webapp::couchdb {
- $x509 = hiera('x509')
- $key = $x509['key']
- $cert = $x509['cert']
- $ca = $x509['ca_cert']
$webapp = hiera('webapp')
# haproxy listener on port localhost:4096, see site_webapp::haproxy
$couchdb_host = 'localhost'
@@ -13,6 +9,21 @@ class site_webapp::couchdb {
$couchdb_webapp_user = $webapp['couchdb_webapp_user']['username']
$couchdb_webapp_password = $webapp['couchdb_webapp_user']['password']
+ $stunnel = hiera('stunnel')
+ $couch_client = $stunnel['couch_client']
+ $couch_client_connect = $couch_client['connect']
+
+ include x509::variable
+ $x509 = hiera('x509')
+ $key = $x509['key']
+ $cert = $x509['cert']
+ $ca = $x509['ca_cert']
+ $cert_name = 'leap_couchdb'
+ $ca_name = 'leap_ca'
+ $ca_path = "${x509::variables::local_CAs}/${ca_name}.crt"
+ $cert_path = "${x509::variables::certs}/${cert_name}.crt"
+ $key_path = "${x509::variables::keys}/${cert_name}.key"
+
file {
'/srv/leap-webapp/config/couchdb.yml.admin':
content => template('site_webapp/couchdb.yml.admin.erb'),
@@ -33,10 +44,11 @@ class site_webapp::couchdb {
mode => '0744';
}
- class { 'site_webapp::couchdb_stunnel':
- key => $key,
- cert => $cert,
- ca => $ca
+ class { 'site_stunnel::setup':
+ cert_name => $cert_name,
+ key => $key,
+ cert => $cert,
+ ca => $ca
}
exec { 'migrate_design_documents':
@@ -45,4 +57,14 @@ class site_webapp::couchdb {
require => Exec['bundler_update'],
notify => Service['apache'];
}
+
+ $couchdb_stunnel_client_defaults = {
+ 'connect_port' => $couch_client_connect,
+ 'client' => true,
+ 'cafile' => $ca_path,
+ 'key' => $key_path,
+ 'cert' => $cert_path,
+ }
+
+ create_resources(site_stunnel::clients, $couch_client, $couchdb_stunnel_client_defaults)
}
diff --git a/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp b/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp
deleted file mode 100644
index 325b18ee..00000000
--- a/puppet/modules/site_webapp/manifests/couchdb_stunnel.pp
+++ /dev/null
@@ -1,43 +0,0 @@
-class site_webapp::couchdb_stunnel ($key, $cert, $ca) {
-
- include x509::variables
- include site_stunnel
-
- $cert_name = 'leap_couchdb'
- $ca_name = 'leap_ca'
- $ca_path = "${x509::variables::local_CAs}/${ca_name}.crt"
- $cert_path = "${x509::variables::certs}/${cert_name}.crt"
- $key_path = "${x509::variables::keys}/${cert_name}.key"
-
- x509::key {
- $cert_name:
- content => $key,
- notify => Service['stunnel'];
- }
-
- x509::cert {
- $cert_name:
- content => $cert,
- notify => Service['stunnel'];
- }
-
- x509::ca {
- $ca_name:
- content => $ca,
- notify => Service['stunnel'];
- }
-
- $couchdb_stunnel_client_defaults = {
- 'client' => true,
- 'cafile' => $ca_path,
- 'key' => $key_path,
- 'cert' => $cert_path,
- 'verify' => '2',
- 'rndfile' => '/var/lib/stunnel4/.rnd',
- 'debuglevel' => '4'
- }
-
- create_resources(site_webapp::couchdb_stunnel::clients, hiera('stunnel'), $couchdb_stunnel_client_defaults)
-
-}
-
diff --git a/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp b/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp
deleted file mode 100644
index eac43b08..00000000
--- a/puppet/modules/site_webapp/manifests/couchdb_stunnel/clients.pp
+++ /dev/null
@@ -1,17 +0,0 @@
-define site_webapp::couchdb_stunnel::clients
- ( $accept_port, $connect, $client, $cafile, $key, $cert,
- $verify, $pid = $name, $rndfile, $debuglevel ) {
-
- stunnel::service { $name:
- accept => "127.0.0.1:${accept_port}",
- connect => "${connect}:6984",
- client => $client,
- cafile => $cafile,
- key => $key,
- cert => $cert,
- verify => $verify,
- pid => "/var/run/stunnel4/${pid}.pid",
- rndfile => $rndfile,
- debuglevel => $debuglevel
- }
- }