fully auto remote host configuration

we do not only export the certificate, but also the config snippet itself
so hosts configure themself fully with an ipsec configuration.

1 files changed, 18 insertions, 5 deletions

diff --git a/manifests/cert.pp b/manifests/cert.pp
index 66ed574..d5baf90 100644
--- a/manifests/cert.pp
+++ b/manifests/cert.pp
@@ -1,11 +1,24 @@
 # manage a cert snippet that we want to include
-define strongswan::cert($cert) {
+define strongswan::cert(
+  $ensure = 'present',
+  $cert   = 'absent'
+) {
+  if ($cert == 'absent') and ($ensure == 'present'){
+    fail("You need to pass some \$cert content for ${name} if it should be present")
+  }
+
   file{"${strongswan::config_dir}/certs/${name}.asc":
-    content => $cert,
+    ensure  => $ensure,
     require => Package['strongswan'],
     notify  => Service['ipsec'],
-    owner   => 'root',
-    group   => 0,
-    mode    => '0400';
+  }
+
+  if $ensure == 'present' {
+    File["${strongswan::config_dir}/certs/${name}.asc"]{
+      content => $cert,
+      owner   => 'root',
+      group   => 0,
+      mode    => '0400',
+    }
   }
 }