|
4 | 4 | # |
5 | 5 | # Parameters: |
6 | 6 | # ['puppet_proxy_port'] - The port for the virtual host |
| 7 | +# ['generate_ssl_certs'] - Generate ssl certs (false to disable) |
7 | 8 | # ['puppet_docroot'] - Apache documnet root |
8 | 9 | # ['apache_serveradmin'] - The apache server admin |
9 | 10 | # ['puppet_conf'] - The puppet config dir |
|
32 | 33 | # |
33 | 34 | class puppet::passenger( |
34 | 35 | $puppet_proxy_port, |
| 36 | + $generate_ssl_certs = true, |
| 37 | + $puppet_passenger_tempdir = false, |
35 | 38 | $puppet_docroot, |
36 | 39 | $apache_serveradmin, |
37 | 40 | $puppet_conf, |
|
46 | 49 | include apache::mod::ssl |
47 | 50 |
|
48 | 51 | if $::osfamily == 'redhat' { |
49 | | - file{'/var/lib/puppet/reports': |
| 52 | + file { '/var/lib/puppet/reports': |
50 | 53 | ensure => directory, |
51 | 54 | owner => $::puppet::params::puppet_user, |
52 | 55 | group => $::puppet::params::puppet_group, |
53 | | - mode => '0750', |
54 | 56 | } |
| 57 | + } |
55 | 58 |
|
| 59 | + if str2bool($generate_ssl_certs) == true { |
56 | 60 | file{"${puppet_ssldir}/ca": |
57 | 61 | ensure => directory, |
58 | 62 | owner => $::puppet::params::puppet_user, |
59 | 63 | group => $::puppet::params::puppet_group, |
60 | | - mode => '0770', |
61 | 64 | before => Exec['Certificate_Check'], |
62 | 65 | } |
63 | 66 |
|
64 | 67 | file{"${puppet_ssldir}/ca/requests": |
65 | 68 | ensure => directory, |
66 | 69 | owner => $::puppet::params::puppet_user, |
67 | 70 | group => $::puppet::params::puppet_group, |
68 | | - mode => '0750', |
69 | 71 | before => Exec['Certificate_Check'], |
70 | 72 | } |
71 | | - } |
| 73 | + # first we need to generate the cert |
| 74 | + # Clean the installed certs out ifrst |
| 75 | + $crt_clean_cmd = "puppet cert clean ${certname}" |
| 76 | + # I would have preferred to use puppet cert generate, but it does not |
| 77 | + # return the corret exit code on some versions of puppet |
| 78 | + $crt_gen_cmd = "puppet certificate --ca-location=local --dns_alt_names=${dns_alt_names} generate ${certname}" |
| 79 | + # I am using the sign command here b/c AFAICT, the sign command for certificate |
| 80 | + # does not work |
| 81 | + $crt_sign_cmd = "puppet cert sign --allow-dns-alt-names ${certname}" |
| 82 | + # find is required to move the cert into the certs directory which is |
| 83 | + # where it needs to be for puppetdb to find it |
| 84 | + $cert_find_cmd = "puppet certificate --ca-location=local find ${certname}" |
72 | 85 |
|
73 | | - # first we need to generate the cert |
74 | | - # Clean the installed certs out ifrst |
75 | | - $crt_clean_cmd = "puppet cert clean ${certname}" |
76 | | - # I would have preferred to use puppet cert generate, but it does not |
77 | | - # return the corret exit code on some versions of puppet |
78 | | - $crt_gen_cmd = "puppet certificate --ca-location=local --dns_alt_names=$dns_alt_names generate ${certname}" |
79 | | - # I am using the sign command here b/c AFAICT, the sign command for certificate |
80 | | - # does not work |
81 | | - $crt_sign_cmd = "puppet cert sign --allow-dns-alt-names ${certname}" |
82 | | - # find is required to move the cert into the certs directory which is |
83 | | - # where it needs to be for puppetdb to find it |
84 | | - $cert_find_cmd = "puppet certificate --ca-location=local find ${certname}" |
85 | | - |
86 | | - exec { 'Certificate_Check': |
87 | | - command => "${crt_clean_cmd} ; ${crt_gen_cmd} && ${crt_sign_cmd} && ${cert_find_cmd}", |
88 | | - unless => "/bin/ls ${puppet_ssldir}/certs/${certname}.pem", |
89 | | - path => '/usr/bin:/usr/local/bin', |
90 | | - logoutput => on_failure, |
91 | | - require => File[$puppet_conf] |
| 86 | + exec { 'Certificate_Check': |
| 87 | + command => "${crt_clean_cmd} ; ${crt_gen_cmd} && ${crt_sign_cmd} && ${cert_find_cmd}", |
| 88 | + unless => "/bin/ls ${puppet_ssldir}/certs/${certname}.pem", |
| 89 | + path => '/usr/bin:/usr/local/bin', |
| 90 | + logoutput => on_failure, |
| 91 | + require => File[$puppet_conf] |
| 92 | + } |
92 | 93 | } |
93 | 94 |
|
94 | 95 | file { $puppet_docroot: |
|
100 | 101 |
|
101 | 102 | apache::vhost { "puppet-${certname}": |
102 | 103 | port => $puppet_proxy_port, |
103 | | - priority => '40', |
104 | | - docroot => $puppet_docroot, |
105 | | - serveradmin => $apache_serveradmin, |
106 | | - servername => $certname, |
107 | | - ssl => true, |
108 | | - ssl_cert => "${puppet_ssldir}/certs/${certname}.pem", |
109 | | - ssl_key => "${puppet_ssldir}/private_keys/${certname}.pem", |
110 | | - ssl_chain => "${puppet_ssldir}/ca/ca_crt.pem", |
111 | | - ssl_ca => "${puppet_ssldir}/ca/ca_crt.pem", |
112 | | - ssl_crl => "${puppet_ssldir}/ca/ca_crl.pem", |
113 | | - ssl_protocol => 'ALL -SSLv2 -SSLv3', |
114 | | - ssl_cipher => 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK', |
| 104 | + priority => '40', |
| 105 | + docroot => $puppet_docroot, |
| 106 | + serveradmin => $apache_serveradmin, |
| 107 | + servername => $certname, |
| 108 | + ssl => true, |
| 109 | + ssl_cert => "${puppet_ssldir}/certs/${certname}.pem", |
| 110 | + ssl_key => "${puppet_ssldir}/private_keys/${certname}.pem", |
| 111 | + ssl_chain => "${puppet_ssldir}/ca/ca_crt.pem", |
| 112 | + ssl_ca => "${puppet_ssldir}/ca/ca_crt.pem", |
| 113 | + ssl_crl => "${puppet_ssldir}/ca/ca_crl.pem", |
| 114 | + ssl_protocol => 'ALL -SSLv2 -SSLv3', |
| 115 | + ssl_cipher => 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK', |
115 | 116 | ssl_honorcipherorder => 'On', |
116 | | - ssl_verify_client => 'optional', |
117 | | - ssl_verify_depth => '1', |
118 | | - ssl_options => ['+StdEnvVars', '+ExportCertData'], |
119 | | - rack_base_uris => '/', |
120 | | - directories => [ |
| 117 | + ssl_verify_client => 'optional', |
| 118 | + ssl_verify_depth => '1', |
| 119 | + ssl_options => ['+StdEnvVars', '+ExportCertData'], |
| 120 | + rack_base_uris => '/', |
| 121 | + directories => [ |
121 | 122 | { |
122 | 123 | path => $puppet_docroot, |
123 | 124 | }, |
|
126 | 127 | options => 'None', |
127 | 128 | }, |
128 | 129 | ], |
129 | | - require => [ File['/etc/puppet/rack/config.ru'], File[$puppet_conf] ], |
| 130 | + require => [ File['/etc/puppet/rack/config.ru'], File[$puppet_conf] ], |
130 | 131 | } |
131 | 132 |
|
132 | 133 | #Hack to add extra passenger configurations for puppetmaster |
|
0 commit comments