1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
|
# manifests/init.pp - module to manage strongswan/ipsec
class strongswan::base {
require monkeysphere
require certtool
package{ 'strongswan' :
ensure => installed,
}
if $selinux == 'true' {
package{ 'strongswan-selinux' :
ensure => installed,
}
}
exec{ 'ipsec_privatekey':
command => "certtool --generate-privkey --bits 2048 --outfile /etc/ipsec.d/private/${::fqdn}.pem",
creates => "/etc/ipsec.d/private/${::fqdn}.pem",
require => Package['strongswan'],
}
exec{ 'ipsec_monkeysphere_cert' :
require => Exec['ipsec_privatekey'],
creates => "/etc/ipsec.d/certs/${::fqdn}.asc",
command => "monkeysphere-host import-key /etc/ipsec.d/private/${::fqdn}.pem ike://${::fqdn} && gpg --homedir /var/lib/monkeysphere/host -a --export =ike://${::fqdn} > /etc/ipsec.d/certs/${::fqdn}.asc"
}
file{ '/etc/ipsec.secrets' :
content => ": RSA ${::fqdn}.pem\n",
require => Package['strongswan'],
owner => "root", group => 0, mode => "400",
notify => Service['ipsec'],
}
if $::strongswan_cert != "false" and $::strongswan_cert != "" {
@@file{ "/etc/ipsec.d/certs/${::fqdn}.asc":
owner => "root", group => 0, mode => "400",
tag => 'strongswan_cert',
content => $::strongswan_cert,
require => Package['strongswan'],
notify => Service['ipsec'],
}
}
File<<| tag == 'strongswan_cert' |>>
file{'/etc/ipsec.conf':
source => "puppet:///modules/site_strongswan/configs/${::fqdn}",
require => Package['strongswan'],
notify => Service['ipsec'],
owner => "root", group => 0, mode => "400";
}
service{'ipsec':
ensure => running,
enable => true,
}
}
|
