From 49064cc0ad4f89dd7aaa2690436c30a26a0385f9 Mon Sep 17 00:00:00 2001
From: o <o@immerda.ch>
Date: Fri, 14 Nov 2014 11:47:35 +0100
Subject: sni: make ssl_cert configurable per vhost

to support sni we configure ssl_certs on a vhost basis.
additionally this commit introduces a generic configuration hash which
will be used to replace most other parameters in the future.
---
 templates/vhosts/0-default_ssl.conf.erb      | 21 +++++++++++++++++++++
 templates/vhosts/default.erb                 |  4 +++-
 templates/vhosts/partials/header_default.erb |  2 ++
 templates/vhosts/partials/ssl.erb            |  5 +++++
 4 files changed, 31 insertions(+), 1 deletion(-)
 create mode 100644 templates/vhosts/0-default_ssl.conf.erb
 create mode 100644 templates/vhosts/partials/ssl.erb

(limited to 'templates/vhosts')

diff --git a/templates/vhosts/0-default_ssl.conf.erb b/templates/vhosts/0-default_ssl.conf.erb
new file mode 100644
index 0000000..86e4979
--- /dev/null
+++ b/templates/vhosts/0-default_ssl.conf.erb
@@ -0,0 +1,21 @@
+############################################################
+### This file is managed by PUPPET!                     ####
+### Only modify in repo or you will loose the changes!  ####
+############################################################
+
+<VirtualHost *:443>
+    Include include.d/defaults.inc
+    Include include.d/ssl_defaults.inc
+    DocumentRoot /var/www/html
+
+    # Use separate log files for the SSL virtual host; note that LogLevel
+    # is not inherited from httpd.conf.
+    ErrorLog logs/ssl_error_log
+    TransferLog logs/ssl_access_log
+    LogLevel warn
+
+<%= scope.function_templatewlv(['apache/vhosts/partials/ssl.erb',
+                                {'configuration' => {}}]) %>
+</VirtualHost>
+
+# vim: ts=4 filetype=apache
diff --git a/templates/vhosts/default.erb b/templates/vhosts/default.erb
index 79e713d..f911236 100644
--- a/templates/vhosts/default.erb
+++ b/templates/vhosts/default.erb
@@ -7,7 +7,9 @@ end
 vhost_parts.each do |vhost_part| -%>
 <VirtualHost *:<%= vhost_part == :ssl ? '443' : '80' %> >
 
-<%= scope.function_templatewlv(['apache/vhosts/partials/header_default.erb', {'vhost_part' => vhost_part } ]) %>
+<%= scope.function_templatewlv(['apache/vhosts/partials/header_default.erb',
+                                {'vhost_part'    => vhost_part,
+                                 'configuration' => configuration,}]) %>
 
 <%= scope.function_template(['apache/vhosts/partials/logs.erb']) %>
 
diff --git a/templates/vhosts/partials/header_default.erb b/templates/vhosts/partials/header_default.erb
index 266fc79..cd4d04c 100644
--- a/templates/vhosts/partials/header_default.erb
+++ b/templates/vhosts/partials/header_default.erb
@@ -1,6 +1,8 @@
   Include include.d/defaults.inc
 <% if vhost_part == :ssl -%>
   Include include.d/ssl_defaults.inc
+<%= scope.function_templatewlv(['apache/vhosts/partials/ssl.erb',
+                                {'configuration' => configuration}]) %>
 <% end -%>
   ServerName <%= @servername %>
 <% unless @serveralias.empty? || (@serveralias == 'absent') -%>
diff --git a/templates/vhosts/partials/ssl.erb b/templates/vhosts/partials/ssl.erb
new file mode 100644
index 0000000..24e28f5
--- /dev/null
+++ b/templates/vhosts/partials/ssl.erb
@@ -0,0 +1,5 @@
+  SSLCertificateFile <%= configuration['ssl_certificate_file'] || scope.lookupvar('apache::default_ssl_certificate_file') %>
+  SSLCertificateKeyFile <%= configuration['ssl_certificate_key_file'] || scope.lookupvar('apache::default_ssl_certificate_key_file') %>
+<% if configuration['ssl_certificate_chain_file'] || scope.lookupvar('apache::default_ssl_certificate_chain_file') != 'absent' -%>
+  SSLCertificateChainFile <%= configuration['ssl_certificate_chain_file'] || scope.lookupvar('apache::default_ssl_certificate_chain_file') %>
+<% end -%>
-- 
cgit v1.2.3