From 1ce6cb5a30c5ee73d6474ac9c1bbd4c7819d9a73 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:19:00 +0200
Subject: only deploy x509 stuff for nodes if it existes in hiera (Feature
 #3875)

---
 puppet/modules/site_config/manifests/default.pp    |  2 --
 puppet/modules/site_config/manifests/x509.pp       | 28 ----------------------
 puppet/modules/site_config/manifests/x509/ca.pp    |  9 +++++++
 .../site_config/manifests/x509/ca_bundle.pp        | 10 ++++++++
 .../modules/site_config/manifests/x509/cert_key.pp | 15 ++++++++++++
 .../site_config/manifests/x509/client_ca.pp        |  9 +++++++
 puppet/modules/site_couchdb/manifests/stunnel.pp   |  5 ++++
 puppet/modules/site_mx/manifests/init.pp           |  5 ++++
 puppet/modules/site_nickserver/manifests/init.pp   |  5 ++++
 puppet/modules/site_openvpn/manifests/init.pp      |  6 ++++-
 puppet/modules/site_postfix/manifests/mx.pp        |  8 ++++++-
 puppet/modules/site_webapp/manifests/couchdb.pp    |  2 ++
 puppet/modules/soledad/manifests/server.pp         |  3 +++
 13 files changed, 75 insertions(+), 32 deletions(-)
 delete mode 100644 puppet/modules/site_config/manifests/x509.pp
 create mode 100644 puppet/modules/site_config/manifests/x509/ca.pp
 create mode 100644 puppet/modules/site_config/manifests/x509/ca_bundle.pp
 create mode 100644 puppet/modules/site_config/manifests/x509/cert_key.pp
 create mode 100644 puppet/modules/site_config/manifests/x509/client_ca.pp

diff --git a/puppet/modules/site_config/manifests/default.pp b/puppet/modules/site_config/manifests/default.pp
index 83a344a2..b27e99af 100644
--- a/puppet/modules/site_config/manifests/default.pp
+++ b/puppet/modules/site_config/manifests/default.pp
@@ -62,6 +62,4 @@ class site_config::default {
     include site_squid_deb_proxy::client
   }
 
-  include site_config::x509
-
 }
diff --git a/puppet/modules/site_config/manifests/x509.pp b/puppet/modules/site_config/manifests/x509.pp
deleted file mode 100644
index 8eca97e7..00000000
--- a/puppet/modules/site_config/manifests/x509.pp
+++ /dev/null
@@ -1,28 +0,0 @@
-class site_config::x509 {
-
-  $x509      = hiera('x509')
-  $key       = $x509['key']
-  $cert      = $x509['cert']
-  $ca        = $x509['ca_cert']
-  $client_ca = $x509['client_ca_cert']
-
-  x509::key { $site_config::params::cert_name:
-    content => $key
-  }
-
-  x509::cert { $site_config::params::cert_name:
-    content => $cert
-  }
-
-  x509::ca { $site_config::params::ca_name:
-    content => $ca
-  }
-
-  x509::ca { $site_config::params::client_ca_name:
-    content => $client_ca
-  }
-
-  x509::ca { $site_config::params::ca_bundle_name:
-    content => "${ca}${client_ca}"
-  }
-}
diff --git a/puppet/modules/site_config/manifests/x509/ca.pp b/puppet/modules/site_config/manifests/x509/ca.pp
new file mode 100644
index 00000000..b16d0eeb
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/ca.pp
@@ -0,0 +1,9 @@
+class site_config::x509::ca {
+
+  $x509      = hiera('x509')
+  $ca        = $x509['ca_cert']
+
+  x509::ca { $site_config::params::ca_name:
+    content => $ca
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/ca_bundle.pp b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
new file mode 100644
index 00000000..204f0a5e
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
@@ -0,0 +1,10 @@
+class site_config::x509::ca_bundle {
+
+  $x509      = hiera('x509')
+  $ca        = $x509['ca_cert']
+  $client_ca = $x509['client_ca_cert']
+
+  x509::ca { $site_config::params::ca_bundle_name:
+    content => "${ca}${client_ca}"
+  }
+}
diff --git a/puppet/modules/site_config/manifests/x509/cert_key.pp b/puppet/modules/site_config/manifests/x509/cert_key.pp
new file mode 100644
index 00000000..d55c6cf2
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/cert_key.pp
@@ -0,0 +1,15 @@
+class site_config::x509::cert_key {
+
+  $x509      = hiera('x509')
+  $key       = $x509['key']
+  $cert      = $x509['cert']
+
+  x509::key { $site_config::params::cert_name:
+    content => $key
+  }
+
+  x509::cert { $site_config::params::cert_name:
+    content => $cert
+  }
+
+}
diff --git a/puppet/modules/site_config/manifests/x509/client_ca.pp b/puppet/modules/site_config/manifests/x509/client_ca.pp
new file mode 100644
index 00000000..f91ea970
--- /dev/null
+++ b/puppet/modules/site_config/manifests/x509/client_ca.pp
@@ -0,0 +1,9 @@
+class site_config::x509::client_ca {
+
+  $x509      = hiera('x509')
+  $client_ca = $x509['client_ca_cert']
+
+  x509::ca { $site_config::params::client_ca_name:
+    content => $client_ca
+  }
+}
diff --git a/puppet/modules/site_couchdb/manifests/stunnel.pp b/puppet/modules/site_couchdb/manifests/stunnel.pp
index 993555cb..fbb75000 100644
--- a/puppet/modules/site_couchdb/manifests/stunnel.pp
+++ b/puppet/modules/site_couchdb/manifests/stunnel.pp
@@ -18,6 +18,11 @@ class site_couchdb::stunnel {
   $ednp_server_connect  = $ednp_server['connect']
   $ednp_clients         = $stunnel['ednp_clients']
 
+
+
+  include site_config::x509::cert_key
+  include site_config::x509::ca
+
   include x509::variables
   $ca_path   = "${x509::variables::local_CAs}/${site_config::params::ca_name}.crt"
   $cert_path = "${x509::variables::certs}/${site_config::params::cert_name}.crt"
diff --git a/puppet/modules/site_mx/manifests/init.pp b/puppet/modules/site_mx/manifests/init.pp
index 3d8469fd..527dc4a5 100644
--- a/puppet/modules/site_mx/manifests/init.pp
+++ b/puppet/modules/site_mx/manifests/init.pp
@@ -2,6 +2,11 @@ class site_mx {
   tag 'leap_service'
   Class['site_config::default'] -> Class['site_mx']
 
+  include site_config::x509::cert_key
+  include site_config::x509::ca
+  include site_config::x509::client_ca
+
+
   include site_postfix::mx
   include site_mx::haproxy
   include site_shorewall::mx
diff --git a/puppet/modules/site_nickserver/manifests/init.pp b/puppet/modules/site_nickserver/manifests/init.pp
index 45503d8a..84b07e77 100644
--- a/puppet/modules/site_nickserver/manifests/init.pp
+++ b/puppet/modules/site_nickserver/manifests/init.pp
@@ -36,6 +36,11 @@ class site_nickserver {
   # temporarily for now:
   $domain          = hiera('domain')
   $address_domain  = $domain['full_suffix']
+
+
+  include site_config::x509::cert_key
+  include site_config::x509::ca
+
   $x509            = hiera('x509')
   $x509_key        = $x509['key']
   $x509_cert       = $x509['cert']
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index fe5ef87f..41f4c6d4 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -20,8 +20,12 @@
 class site_openvpn {
   tag 'leap_service'
 
+  include site_config::x509::cert_key
+  include site_config::x509::ca_bundle
+
+
   Class['site_config::default'] -> Class['site_openvpn']
-  
+
   $openvpn_config   = hiera('openvpn')
   $x509_config      = hiera('x509')
   $openvpn_ports    = $openvpn_config['ports']
diff --git a/puppet/modules/site_postfix/manifests/mx.pp b/puppet/modules/site_postfix/manifests/mx.pp
index 4a7d66ed..32465e01 100644
--- a/puppet/modules/site_postfix/manifests/mx.pp
+++ b/puppet/modules/site_postfix/manifests/mx.pp
@@ -8,6 +8,9 @@ class site_postfix::mx {
   $root_mail_recipient = $mx_hash['contact']
   $postfix_smtp_listen = 'all'
 
+  include site_config::x509::cert_key
+  include site_config::x509::client_ca
+
   postfix::config {
     'mydestination':
       value => "\$myorigin, localhost, localhost.\$mydomain, ${domain}";
@@ -44,6 +47,9 @@ submission inet n        -       n       -       -       smtpd
   -o smtpd_tls_security_level=encrypt
   -o smtpd_recipient_restrictions=\$submission_recipient_restrictions
   -o smtpd_helo_restrictions=\$submission_helo_restrictions",
-    require             => Class['Site_config::X509']
+    require             => [
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Client_ca'],
+      User['vmail'] ]
   }
 }
diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index f9a4eb6b..24f9279d 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -13,6 +13,8 @@ class site_webapp::couchdb {
   $couch_client            = $stunnel['couch_client']
   $couch_client_connect    = $couch_client['connect']
 
+  include site_config::x509::cert_key
+  include site_config::x509::ca
   include x509::variables
   $x509                    = hiera('x509')
   $key                     = $x509['key']
diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index 393d416a..c0af238c 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -9,6 +9,9 @@ class soledad::server {
   $couchdb_user     = $couchdb['couchdb_admin_user']['username']
   $couchdb_password = $couchdb['couchdb_admin_user']['password']
 
+  include site_config::x509::cert_key
+  include site_config::x509::ca
+
   $x509      = hiera('x509')
   $x509_key  = $x509['key']
   $x509_cert = $x509['cert']
-- 
cgit v1.2.3


From c68399c019d09a4c8ba44f47936b4b3842802177 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:29:15 +0200
Subject: tidy openvpn x509 definitions (#3831)

---
 .../site_config/manifests/x509/ca_bundle.pp        |  6 +++
 puppet/modules/site_openvpn/manifests/dh_key.pp    | 10 +++++
 puppet/modules/site_openvpn/manifests/init.pp      |  5 +--
 puppet/modules/site_openvpn/manifests/keys.pp      | 45 ----------------------
 4 files changed, 18 insertions(+), 48 deletions(-)
 create mode 100644 puppet/modules/site_openvpn/manifests/dh_key.pp
 delete mode 100644 puppet/modules/site_openvpn/manifests/keys.pp

diff --git a/puppet/modules/site_config/manifests/x509/ca_bundle.pp b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
index 204f0a5e..4cbe574a 100644
--- a/puppet/modules/site_config/manifests/x509/ca_bundle.pp
+++ b/puppet/modules/site_config/manifests/x509/ca_bundle.pp
@@ -1,5 +1,11 @@
 class site_config::x509::ca_bundle {
 
+  # CA bundle -- we want to have the possibility of allowing multiple CAs.
+  # For now, the reason is to transition to using client CA. In the future,
+  # we will want to be able to smoothly phase out one CA and phase in another.
+  # I tried "--capath" for this, but it did not work.
+
+
   $x509      = hiera('x509')
   $ca        = $x509['ca_cert']
   $client_ca = $x509['client_ca_cert']
diff --git a/puppet/modules/site_openvpn/manifests/dh_key.pp b/puppet/modules/site_openvpn/manifests/dh_key.pp
new file mode 100644
index 00000000..13cc0f5b
--- /dev/null
+++ b/puppet/modules/site_openvpn/manifests/dh_key.pp
@@ -0,0 +1,10 @@
+class site_openvpn::dh_key {
+
+  $x509_config      = hiera('x509')
+
+  file { '/etc/openvpn/keys/dh.pem':
+    content => $x509_config['dh'],
+    mode    => '0644',
+  }
+
+}
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 41f4c6d4..29b3f13f 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -27,7 +27,6 @@ class site_openvpn {
   Class['site_config::default'] -> Class['site_openvpn']
 
   $openvpn_config   = hiera('openvpn')
-  $x509_config      = hiera('x509')
   $openvpn_ports    = $openvpn_config['ports']
 
   if $::ec2_instance_id {
@@ -62,8 +61,8 @@ class site_openvpn {
     $openvpn_limited_udp_cidr             = '21'
   }
 
-  # deploy ca + server keys
-  include site_openvpn::keys
+  # deploy dh keys
+  include site_openvpn::dh_key
 
   if $openvpn_allow_unlimited and $openvpn_allow_limited {
     $unlimited_gateway_address = $openvpn_gateway_address
diff --git a/puppet/modules/site_openvpn/manifests/keys.pp b/puppet/modules/site_openvpn/manifests/keys.pp
deleted file mode 100644
index 864bbd9b..00000000
--- a/puppet/modules/site_openvpn/manifests/keys.pp
+++ /dev/null
@@ -1,45 +0,0 @@
-class site_openvpn::keys {
-
-  x509::key {
-    'leap_openvpn':
-      content => $site_openvpn::x509_config['key'],
-      notify  => Service[openvpn];
-  }
-
-  x509::cert {
-    'leap_openvpn':
-      content => $site_openvpn::x509_config['cert'],
-      notify  => Service[openvpn];
-  }
-
-  file { '/etc/openvpn/keys/dh.pem':
-    content => $site_openvpn::x509_config['dh'],
-    mode    => '0644',
-  }
-
-  #
-  # CA bundle -- we want to have the possibility of allowing multiple CAs.
-  # For now, the reason is to transition to using client CA. In the future,
-  # we will want to be able to smoothly phase out one CA and phase in another.
-  # I tried "--capath" for this, but it did not work.
-  #
-
-  concat {
-    '/etc/openvpn/ca_bundle.pem':
-      owner  => root,
-      group  => root,
-      mode   => 644,
-      warn   => true,
-      notify => Service['openvpn'];
-  }
-
-  concat::fragment {
-    'client_ca_cert':
-      content => $site_openvpn::x509_config['client_ca_cert'],
-      target  => '/etc/openvpn/ca_bundle.pem';
-    'ca_cert':
-      content => $site_openvpn::x509_config['ca_cert'],
-      target  => '/etc/openvpn/ca_bundle.pem';
-  }
-
-}
-- 
cgit v1.2.3


From 12d22a47ad529f02e0c6d27b25f7ddaa17a32727 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:32:35 +0200
Subject: soledad should use default key, cert and ca (Feature #3841)

---
 puppet/modules/soledad/manifests/server.pp | 31 ++++++++----------------------
 1 file changed, 8 insertions(+), 23 deletions(-)

diff --git a/puppet/modules/soledad/manifests/server.pp b/puppet/modules/soledad/manifests/server.pp
index c0af238c..0c073443 100644
--- a/puppet/modules/soledad/manifests/server.pp
+++ b/puppet/modules/soledad/manifests/server.pp
@@ -12,29 +12,9 @@ class soledad::server {
   include site_config::x509::cert_key
   include site_config::x509::ca
 
-  $x509      = hiera('x509')
-  $x509_key  = $x509['key']
-  $x509_cert = $x509['cert']
-  $x509_ca   = $x509['ca_cert']
-
   $soledad      = hiera('soledad')
   $soledad_port = $soledad['port']
 
-  x509::key { 'soledad':
-    content => $x509_key,
-    notify  => Service['soledad-server'];
-  }
-
-  x509::cert { 'soledad':
-    content => $x509_cert,
-    notify  => Service['soledad-server'];
-  }
-
-  x509::ca { 'soledad':
-    content => $x509_ca,
-    notify  => Service['soledad-server'];
-  }
-
   #
   # SOLEDAD CONFIG
   #
@@ -50,8 +30,9 @@ class soledad::server {
 
   package { 'soledad-server':
     ensure  => latest,
-    require => [ Class['site_apt::preferences::twisted'],
-                 Class['site_apt::leap_repo'] ];
+    require => [
+      Class['site_apt::preferences::twisted'],
+      Class['site_apt::leap_repo'] ];
   }
 
   file { '/etc/default/soledad':
@@ -68,7 +49,11 @@ class soledad::server {
     enable     => true,
     hasstatus  => true,
     hasrestart => true,
-    require    => [ Class['soledad'], Package['soledad-server'] ];
+    require    => [
+      Class['soledad'],
+      Package['soledad-server'],
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca'] ];
   }
 
   include site_shorewall::soledad
-- 
cgit v1.2.3


From d7aca479f254ce4cbe58ee2a2197ea5c6d02de53 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 12:44:30 +0200
Subject: Depend services on deployment of default key, cert and ca (Feature
 #3838)

---
 puppet/modules/site_couchdb/manifests/stunnel.pp | 15 ++++++++++++---
 puppet/modules/site_openvpn/manifests/init.pp    |  6 +++++-
 puppet/modules/site_stunnel/manifests/clients.pp |  6 +++++-
 3 files changed, 22 insertions(+), 5 deletions(-)

diff --git a/puppet/modules/site_couchdb/manifests/stunnel.pp b/puppet/modules/site_couchdb/manifests/stunnel.pp
index fbb75000..7ba303fe 100644
--- a/puppet/modules/site_couchdb/manifests/stunnel.pp
+++ b/puppet/modules/site_couchdb/manifests/stunnel.pp
@@ -39,7 +39,10 @@ class site_couchdb::stunnel {
     verify     => '2',
     pid        => '/var/run/stunnel4/couchserver.pid',
     rndfile    => '/var/lib/stunnel4/.rnd',
-    debuglevel => '4'
+    debuglevel => '4',
+    require    => [
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca'] ];
   }
 
 
@@ -55,7 +58,10 @@ class site_couchdb::stunnel {
     verify     => '2',
     pid        => '/var/run/stunnel4/epmd_server.pid',
     rndfile    => '/var/lib/stunnel4/.rnd',
-    debuglevel => '4'
+    debuglevel => '4',
+    require    => [
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca'] ];
   }
 
   # setup stunnel clients for Erlang Port Mapper Daemon (epmd) to connect
@@ -81,7 +87,10 @@ class site_couchdb::stunnel {
     verify     => '2',
     pid        => '/var/run/stunnel4/ednp_server.pid',
     rndfile    => '/var/lib/stunnel4/.rnd',
-    debuglevel => '4'
+    debuglevel => '4',
+    require    => [
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca'] ];
   }
 
   # setup stunnel clients for Erlang Distributed Node Protocol (ednp) to connect
diff --git a/puppet/modules/site_openvpn/manifests/init.pp b/puppet/modules/site_openvpn/manifests/init.pp
index 29b3f13f..6ab0d430 100644
--- a/puppet/modules/site_openvpn/manifests/init.pp
+++ b/puppet/modules/site_openvpn/manifests/init.pp
@@ -137,7 +137,11 @@ class site_openvpn {
     command     => '/etc/init.d/openvpn restart',
     refreshonly => true,
     subscribe   => File['/etc/openvpn'],
-    require     => [ Package['openvpn'], File['/etc/openvpn'] ];
+    require     => [
+      Package['openvpn'],
+      File['/etc/openvpn'],
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca_bundle'] ];
   }
 
   cron { 'add_gateway_ips.sh':
diff --git a/puppet/modules/site_stunnel/manifests/clients.pp b/puppet/modules/site_stunnel/manifests/clients.pp
index ed766e1a..b2c8db1f 100644
--- a/puppet/modules/site_stunnel/manifests/clients.pp
+++ b/puppet/modules/site_stunnel/manifests/clients.pp
@@ -21,6 +21,10 @@ define site_stunnel::clients (
     verify     => $verify,
     pid        => "/var/run/stunnel4/${pid}.pid",
     rndfile    => $rndfile,
-    debuglevel => $debuglevel
+    debuglevel => $debuglevel,
+    require    => [
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca'] ];
+
   }
 }
-- 
cgit v1.2.3


From b798d716e5219d00b5b94ce8b80566e4b3bf0899 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 13:11:24 +0200
Subject: webapp: Depend services on deployment of default key, cert and ca
 (Feature #3838)

---
 .../site_config/manifests/x509/client_ca.pp        |  5 +++++
 puppet/modules/site_webapp/manifests/apache.pp     | 24 ++++++++-------------
 puppet/modules/site_webapp/manifests/client_ca.pp  | 25 ----------------------
 puppet/modules/site_webapp/manifests/couchdb.pp    | 19 ++++------------
 puppet/modules/site_webapp/manifests/init.pp       |  3 ++-
 5 files changed, 20 insertions(+), 56 deletions(-)
 delete mode 100644 puppet/modules/site_webapp/manifests/client_ca.pp

diff --git a/puppet/modules/site_config/manifests/x509/client_ca.pp b/puppet/modules/site_config/manifests/x509/client_ca.pp
index f91ea970..3e914cf5 100644
--- a/puppet/modules/site_config/manifests/x509/client_ca.pp
+++ b/puppet/modules/site_config/manifests/x509/client_ca.pp
@@ -1,5 +1,10 @@
 class site_config::x509::client_ca {
 
+  ##
+  ## This is for the special CA that is used exclusively for generating
+  ## client certificates by the webapp.
+  ##
+
   $x509      = hiera('x509')
   $client_ca = $x509['client_ca_cert']
 
diff --git a/puppet/modules/site_webapp/manifests/apache.pp b/puppet/modules/site_webapp/manifests/apache.pp
index 4331afe4..3dd1c4c7 100644
--- a/puppet/modules/site_webapp/manifests/apache.pp
+++ b/puppet/modules/site_webapp/manifests/apache.pp
@@ -8,9 +8,15 @@ class site_webapp::apache {
   $commercial_key   = $x509['commercial_key']
   $commercial_cert  = $x509['commercial_cert']
   $commercial_root  = $x509['commercial_ca_cert']
-  $api_key          = $x509['key']
-  $api_cert         = $x509['cert']
-  $api_root         = $x509['ca_cert']
+
+  include site_config::x509::cert_key
+  include site_config::x509::ca
+
+  include x509::variables
+
+  X509::Cert[$site_config::params::cert_name] ~> Service[apache]
+  X509::Key[$site_config::params::cert_name]  ~> Service[apache]
+  X509::Ca[$site_config::params::ca_name]  ~> Service[apache]
 
   class { '::apache': no_default_site => true, ssl => true }
 
@@ -34,29 +40,17 @@ class site_webapp::apache {
     'leap_webapp':
       content => $commercial_key,
       notify  => Service[apache];
-
-    'leap_api':
-      content => $api_key,
-      notify  => Service[apache];
   }
 
   x509::cert {
     'leap_webapp':
       content => $commercial_cert,
       notify  => Service[apache];
-
-    'leap_api':
-      content => $api_cert,
-      notify  => Service[apache];
   }
 
   x509::ca {
     'leap_webapp':
       content => $commercial_root,
       notify  => Service[apache];
-
-    'leap_api':
-      content => $api_root,
-      notify  => Service[apache];
   }
 }
diff --git a/puppet/modules/site_webapp/manifests/client_ca.pp b/puppet/modules/site_webapp/manifests/client_ca.pp
deleted file mode 100644
index 0d9b15d6..00000000
--- a/puppet/modules/site_webapp/manifests/client_ca.pp
+++ /dev/null
@@ -1,25 +0,0 @@
-##
-## This is for the special CA that is used exclusively for generating
-## client certificates by the webapp.
-##
-
-class site_webapp::client_ca {
-  include x509::variables
-
-  $x509 = hiera('x509')
-  $cert_path = "${x509::variables::certs}/leap_client_ca.crt"
-  $key_path = "${x509::variables::keys}/leap_client_ca.key"
-
-  x509::key {
-    'leap_client_ca':
-      source => $x509['client_ca_key'],
-      group  => 'leap-webapp',
-      notify  => Service[apache];
-  }
-
-  x509::cert {
-    'leap_client_ca':
-      source => $x509['client_ca_cert'],
-      notify  => Service[apache];
-  }
-}
diff --git a/puppet/modules/site_webapp/manifests/couchdb.pp b/puppet/modules/site_webapp/manifests/couchdb.pp
index 24f9279d..5a5cccad 100644
--- a/puppet/modules/site_webapp/manifests/couchdb.pp
+++ b/puppet/modules/site_webapp/manifests/couchdb.pp
@@ -13,18 +13,7 @@ class site_webapp::couchdb {
   $couch_client            = $stunnel['couch_client']
   $couch_client_connect    = $couch_client['connect']
 
-  include site_config::x509::cert_key
-  include site_config::x509::ca
   include x509::variables
-  $x509                    = hiera('x509')
-  $key                     = $x509['key']
-  $cert                    = $x509['cert']
-  $ca                      = $x509['ca_cert']
-  $cert_name               = 'leap_couchdb'
-  $ca_name                 = 'leap_ca'
-  $ca_path                 = "${x509::variables::local_CAs}/${ca_name}.crt"
-  $cert_path               = "${x509::variables::certs}/${cert_name}.crt"
-  $key_path                = "${x509::variables::keys}/${cert_name}.key"
 
   file {
     '/srv/leap/webapp/config/couchdb.yml.admin':
@@ -73,10 +62,10 @@ class site_webapp::couchdb {
 
   $couchdb_stunnel_client_defaults = {
     'connect_port' => $couch_client_connect,
-    'client'     => true,
-    'cafile'     => $ca_path,
-    'key'        => $key_path,
-    'cert'       => $cert_path,
+    'client'       => true,
+    'cafile'       => "${x509::variables::local_CAs}/${site_config::params::ca_name}.crt",
+    'key'          => "${x509::variables::keys}/${site_config::params::cert_name}.key",
+    'cert'         => "${x509::variables::certs}/${site_config::params::cert_name}.crt",
   }
 
   create_resources(site_stunnel::clients, $couch_client, $couchdb_stunnel_client_defaults)
diff --git a/puppet/modules/site_webapp/manifests/init.pp b/puppet/modules/site_webapp/manifests/init.pp
index 97a75010..4b06cea6 100644
--- a/puppet/modules/site_webapp/manifests/init.pp
+++ b/puppet/modules/site_webapp/manifests/init.pp
@@ -16,8 +16,9 @@ class site_webapp {
   include site_config::ruby
   include site_webapp::apache
   include site_webapp::couchdb
-  include site_webapp::client_ca
   include site_webapp::haproxy
+  include site_config::x509::cert_key
+  include site_config::x509::ca
 
   group { 'leap-webapp':
     ensure    => present,
-- 
cgit v1.2.3


From 43a5b322d99effa411c9fddf5f849da70a7768e8 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 13:45:03 +0200
Subject: tidy nickserver x509 definitions (#3842)

---
 puppet/modules/site_nickserver/manifests/init.pp   | 24 ++++------------------
 .../templates/nickserver-proxy.conf.erb            |  6 +++---
 2 files changed, 7 insertions(+), 23 deletions(-)

diff --git a/puppet/modules/site_nickserver/manifests/init.pp b/puppet/modules/site_nickserver/manifests/init.pp
index 84b07e77..a12ed3a2 100644
--- a/puppet/modules/site_nickserver/manifests/init.pp
+++ b/puppet/modules/site_nickserver/manifests/init.pp
@@ -41,11 +41,6 @@ class site_nickserver {
   include site_config::x509::cert_key
   include site_config::x509::ca
 
-  $x509            = hiera('x509')
-  $x509_key        = $x509['key']
-  $x509_cert       = $x509['cert']
-  $x509_ca         = $x509['ca_cert']
-
   #
   # USER AND GROUP
   #
@@ -129,7 +124,10 @@ class site_nickserver {
     enable     => true,
     hasrestart => true,
     hasstatus  => true,
-    require    => File['/etc/init.d/nickserver'];
+    require    => [
+      File['/etc/init.d/nickserver'],
+      Class['Site_config::X509::Cert_key'],
+      Class['Site_config::X509::Ca'] ];
   }
 
   #
@@ -165,18 +163,4 @@ class site_nickserver {
       content => template('site_nickserver/nickserver-proxy.conf.erb')
   }
 
-  x509::key { 'nickserver':
-    content => $x509_key,
-    notify  => Service[apache];
-  }
-
-  x509::cert { 'nickserver':
-    content => $x509_cert,
-    notify  => Service[apache];
-  }
-
-  x509::ca { 'nickserver':
-    content => $x509_ca,
-    notify  => Service[apache];
-  }
 }
diff --git a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
index 67896cd3..478ae7f1 100644
--- a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
+++ b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
@@ -14,9 +14,9 @@ Listen 0.0.0.0:<%= @nickserver_port -%>
   SSLHonorCipherOrder on
 
   SSLCACertificatePath /etc/ssl/certs
-  SSLCertificateChainFile /etc/ssl/certs/nickserver.pem
-  SSLCertificateKeyFile /etc/x509/keys/nickserver.key
-  SSLCertificateFile /etc/x509/certs/nickserver.crt
+  SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
+  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key 
+  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt 
 
   ProxyPass / http://localhost:<%= @nickserver_local_port %>/
   ProxyPreserveHost On  # preserve Host header in HTTP request
-- 
cgit v1.2.3


From 55578fec453d6b090f623fd3368138f9e322c9f5 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 13:48:07 +0200
Subject: tidy webapp api x509 definitions (#3840)

---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index bc5ff156..4efbbc52 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -15,9 +15,9 @@ Listen 0.0.0.0:<%= api_port %>
   SSLHonorCipherOrder on
 
   SSLCACertificatePath /etc/ssl/certs
-  SSLCertificateChainFile /etc/ssl/certs/leap_api.pem
-  SSLCertificateKeyFile /etc/x509/keys/leap_api.key
-  SSLCertificateFile /etc/x509/certs/leap_api.crt
+  SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
+  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key   
+  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt   
 
   RequestHeader set X_FORWARDED_PROTO 'https'
 
-- 
cgit v1.2.3


From 77a2c7864953886e8861217bb4947bae6366acc8 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 13:50:27 +0200
Subject: tidy soledad x509 definitions (#3841)

---
 puppet/modules/soledad/templates/default-soledad.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/soledad/templates/default-soledad.erb b/puppet/modules/soledad/templates/default-soledad.erb
index fd38903a..32504e38 100644
--- a/puppet/modules/soledad/templates/default-soledad.erb
+++ b/puppet/modules/soledad/templates/default-soledad.erb
@@ -1,5 +1,5 @@
 # this file is managed by puppet
 START=yes
-CERT_PATH=/etc/x509/certs/soledad.crt
-PRIVKEY_PATH=/etc/x509/keys/soledad.key
+CERT_PATH=<%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
+PRIVKEY_PATH=<%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
 HTTPS_PORT=<%=@soledad_port%>
-- 
cgit v1.2.3


From 0397643c8c10de21fb67e0de9cd86c323bbbc3da Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Thu, 19 Sep 2013 16:49:53 +0200
Subject: fix x509 path in webapp config.yml.erb (#3894)

---
 puppet/modules/site_webapp/templates/config.yml.erb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/puppet/modules/site_webapp/templates/config.yml.erb b/puppet/modules/site_webapp/templates/config.yml.erb
index 05d62d41..57e4ccb6 100644
--- a/puppet/modules/site_webapp/templates/config.yml.erb
+++ b/puppet/modules/site_webapp/templates/config.yml.erb
@@ -3,8 +3,8 @@ production:
   admins: <%= @webapp['admins'].inspect %>
   domain: <%= @provider_domain %>
   force_ssl: <%= @webapp['secure'] %>
-  client_ca_key: <%= scope.lookupvar('site_webapp::client_ca::key_path') %>
-  client_ca_cert: <%= scope.lookupvar('site_webapp::client_ca::cert_path') %>
+  client_ca_key: <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
+  client_ca_cert: <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt 
   secret_token: "<%= @secret_token %>"
   client_cert_lifespan: <%= cert_options['life_span'].to_i %>
   client_cert_bit_size: <%= cert_options['bit_size'].to_i %>
-- 
cgit v1.2.3


From 486a9cd3b7bd8d643a9623fd40db2286cdf52fc8 Mon Sep 17 00:00:00 2001
From: varac <varacanero@zeromail.org>
Date: Fri, 20 Sep 2013 18:58:13 +0200
Subject: fix whitespace issues from https://review.leap.se/r/82

---
 puppet/modules/site_apache/templates/vhosts.d/api.conf.erb         | 4 ++--
 puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb | 4 ++--
 puppet/modules/site_webapp/templates/config.yml.erb                | 2 +-
 3 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
index 4efbbc52..5f1f4c1d 100644
--- a/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
+++ b/puppet/modules/site_apache/templates/vhosts.d/api.conf.erb
@@ -16,8 +16,8 @@ Listen 0.0.0.0:<%= api_port %>
 
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
-  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key   
-  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt   
+  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
+  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
 
   RequestHeader set X_FORWARDED_PROTO 'https'
 
diff --git a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
index 478ae7f1..ae06410e 100644
--- a/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
+++ b/puppet/modules/site_nickserver/templates/nickserver-proxy.conf.erb
@@ -15,8 +15,8 @@ Listen 0.0.0.0:<%= @nickserver_port -%>
 
   SSLCACertificatePath /etc/ssl/certs
   SSLCertificateChainFile <%= scope.lookupvar('x509::variables::local_CAs') %>/<%= scope.lookupvar('site_config::params::ca_name') %>.crt
-  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key 
-  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt 
+  SSLCertificateKeyFile <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
+  SSLCertificateFile <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
 
   ProxyPass / http://localhost:<%= @nickserver_local_port %>/
   ProxyPreserveHost On  # preserve Host header in HTTP request
diff --git a/puppet/modules/site_webapp/templates/config.yml.erb b/puppet/modules/site_webapp/templates/config.yml.erb
index 57e4ccb6..0ce623fc 100644
--- a/puppet/modules/site_webapp/templates/config.yml.erb
+++ b/puppet/modules/site_webapp/templates/config.yml.erb
@@ -4,7 +4,7 @@ production:
   domain: <%= @provider_domain %>
   force_ssl: <%= @webapp['secure'] %>
   client_ca_key: <%= scope.lookupvar('x509::variables::keys') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.key
-  client_ca_cert: <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt 
+  client_ca_cert: <%= scope.lookupvar('x509::variables::certs') %>/<%= scope.lookupvar('site_config::params::cert_name') %>.crt
   secret_token: "<%= @secret_token %>"
   client_cert_lifespan: <%= cert_options['life_span'].to_i %>
   client_cert_bit_size: <%= cert_options['bit_size'].to_i %>
-- 
cgit v1.2.3