summaryrefslogtreecommitdiff
path: root/manifests/base.pp
blob: f0be227070ff43d16a5aec83736acd7d5c5f952c (plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
# manifests/init.pp - module to manage strongswan/ipsec

class strongswan::base {

  require monkeysphere
  require certtool

  package{ 'strongswan' :
    ensure => installed,
  }

  exec{ 'ipsec_privatekey':
    command => "certtool --generate-privkey --bits 2048 --outfile /etc/ipsec.d/private/${fqdn}.pem",
    creates => "/etc/ipsec.d/private/${fqdn}.pem",
    require => Package['strongswan'],
  }

  exec{ 'ipsec_monkeysphere_cert' :
    require => Exec['ipsec_privatekey'],
    creates => "/etc/ipsec.d/certs/${fqdn}.asc",
    command => "monkeysphere-host import-key /etc/ipsec.d/private/${fqdn}.pem ike://${fqdn} && gpg --homedir /var/lib/monkeysphere/host -a --export =ike://${fqdn} > /etc/ipsec.d/certs/${fqdn}.asc"
  }

  file{ '/etc/ipsec.secrets' : 
    content => ": RSA ${fqdn}.pem\n",
    require => Package['strongswan'],
    owner => "root", group => 0, mode => "400",
    notify => Service['strongswan'],
  }

  if $strongswan_cert != "false" and $strongswan_cert != "" {
    @@file{ "/etc/ipsec.d/certs/${fqdn}.asc":
      owner => "root", group => 0, mode => "400",
      tag => 'strongswan_cert',
      content => $strongswan_cert,
      require => Package['strongswan'],
      notify => Service['strongswan'],
    }
  }  

  File<<| tag == 'strongswan_cert' |>>

  file{ '/etc/ipsec.config' :
    source => "puppet:///modules/site-strongswan/configs/${fqdn}",
    owner => "root", group => 0, mode => "400",
    require => Package['strongswan'],
    notify => Service['strongswan'],
  }

  service{ 'strongswan' :
    ensure => running,
    enable => true,
  }

}