Skip to content

Commit d019fe5

Browse files
stephenrjohnsonStephen
stephenrjohnson
authored and
Stephen
committed
Merge branch 'yo61-feature/make_ssl_setup_optional'
2 parents b04a8e9 + a79c615 commit d019fe5

File tree

2 files changed

+55
-49
lines changed

2 files changed

+55
-49
lines changed

‎manifests/master.pp‎

Lines changed: 11 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
# ['puppetdb_startup_timeout'] - The timeout for puppetdb
3333
# ['dns_alt_names'] - Comma separated list of alternative DNS names
3434
# ['digest_algorithm'] - The algorithm to use for file digests.
35+
# ['generate_ssl_certs'] - Generate ssl certs (false to disable)
3536
#
3637
# Requires:
3738
#
@@ -83,6 +84,7 @@
8384
$puppetdb_strict_validation = $::puppet::params::puppetdb_strict_validation,
8485
$dns_alt_names = ['puppet'],
8586
$digest_algorithm = $::puppet::params::digest_algorithm,
87+
$generate_ssl_certs = true,
8688
) inherits puppet::params {
8789

8890
anchor { 'puppet::master::begin': }
@@ -121,14 +123,15 @@
121123

122124
Anchor['puppet::master::begin'] ->
123125
class {'puppet::passenger':
124-
puppet_passenger_port => $puppet_passenger_port,
125-
puppet_docroot => $puppet_docroot,
126-
apache_serveradmin => $apache_serveradmin,
127-
puppet_conf => $::puppet::params::puppet_conf,
128-
puppet_ssldir => $puppet_ssldir,
129-
certname => $certname,
130-
conf_dir => $::puppet::params::confdir,
131-
dns_alt_names => join($dns_alt_names,','),
126+
puppet_passenger_port => $puppet_passenger_port,
127+
puppet_docroot => $puppet_docroot,
128+
apache_serveradmin => $apache_serveradmin,
129+
puppet_conf => $::puppet::params::puppet_conf,
130+
puppet_ssldir => $puppet_ssldir,
131+
certname => $certname,
132+
conf_dir => $::puppet::params::confdir,
133+
dns_alt_names => join($dns_alt_names,','),
134+
generate_ssl_certs => $generate_ssl_certs,
132135
} ->
133136
Anchor['puppet::master::end']
134137

‎manifests/passenger.pp‎

Lines changed: 44 additions & 41 deletions
Original file line numberDiff line numberDiff line change
@@ -3,6 +3,7 @@
33
# This class installs and configures the puppetdb terminus pacakge
44
#
55
# Parameters:
6+
# ['generate_ssl_certs'] - Generate ssl certs (false to disable)
67
# ['puppet_passenger_port'] - The port for the virtual host
78
# ['puppet_docroot'] - Apache documnet root
89
# ['apache_serveradmin'] - The apache server admin
@@ -31,6 +32,7 @@
3132
# }
3233
#
3334
class puppet::passenger(
35+
$generate_ssl_certs = true,
3436
$puppet_passenger_port,
3537
$puppet_docroot,
3638
$apache_serveradmin,
@@ -51,41 +53,42 @@
5153
owner => $::puppet::params::puppet_user,
5254
group => $::puppet::params::puppet_group,
5355
}
56+
}
5457

55-
file { "${puppet_ssldir}/ca":
58+
if str2bool($generate_ssl_certs) == true {
59+
file{"${puppet_ssldir}/ca":
5660
ensure => directory,
5761
owner => $::puppet::params::puppet_user,
5862
group => $::puppet::params::puppet_group,
5963
before => Exec['Certificate_Check'],
6064
}
6165

62-
file { "${puppet_ssldir}/ca/requests":
66+
file{"${puppet_ssldir}/ca/requests":
6367
ensure => directory,
6468
owner => $::puppet::params::puppet_user,
6569
group => $::puppet::params::puppet_group,
6670
before => Exec['Certificate_Check'],
6771
}
68-
}
72+
# first we need to generate the cert
73+
# Clean the installed certs out ifrst
74+
$crt_clean_cmd = "puppet cert clean ${certname}"
75+
# I would have preferred to use puppet cert generate, but it does not
76+
# return the corret exit code on some versions of puppet
77+
$crt_gen_cmd = "puppet certificate --ca-location=local --dns_alt_names=$dns_alt_names generate ${certname}"
78+
# I am using the sign command here b/c AFAICT, the sign command for certificate
79+
# does not work
80+
$crt_sign_cmd = "puppet cert sign --allow-dns-alt-names ${certname}"
81+
# find is required to move the cert into the certs directory which is
82+
# where it needs to be for puppetdb to find it
83+
$cert_find_cmd = "puppet certificate --ca-location=local find ${certname}"
6984

70-
# first we need to generate the cert
71-
# Clean the installed certs out ifrst
72-
$crt_clean_cmd = "puppet cert clean ${certname}"
73-
# I would have preferred to use puppet cert generate, but it does not
74-
# return the corret exit code on some versions of puppet
75-
$crt_gen_cmd = "puppet certificate --ca-location=local --dns_alt_names=$dns_alt_names generate ${certname}"
76-
# I am using the sign command here b/c AFAICT, the sign command for certificate
77-
# does not work
78-
$crt_sign_cmd = "puppet cert sign --allow-dns-alt-names ${certname}"
79-
# find is required to move the cert into the certs directory which is
80-
# where it needs to be for puppetdb to find it
81-
$cert_find_cmd = "puppet certificate --ca-location=local find ${certname}"
82-
83-
exec { 'Certificate_Check':
84-
command => "${crt_clean_cmd} ; ${crt_gen_cmd} && ${crt_sign_cmd} && ${cert_find_cmd}",
85-
unless => "/bin/ls ${puppet_ssldir}/certs/${certname}.pem",
86-
path => '/usr/bin:/usr/local/bin',
87-
logoutput => on_failure,
88-
require => File[$puppet_conf]
85+
exec { 'Certificate_Check':
86+
command => "${crt_clean_cmd} ; ${crt_gen_cmd} && ${crt_sign_cmd} && ${cert_find_cmd}",
87+
unless => "/bin/ls ${puppet_ssldir}/certs/${certname}.pem",
88+
path => '/usr/bin:/usr/local/bin',
89+
logoutput => on_failure,
90+
require => File[$puppet_conf]
91+
}
8992
}
9093

9194
file { $puppet_docroot:
@@ -96,25 +99,25 @@
9699
}
97100

98101
apache::vhost { "puppet-${certname}":
99-
port => $puppet_passenger_port,
100-
priority => '40',
101-
docroot => $puppet_docroot,
102-
serveradmin => $apache_serveradmin,
103-
servername => $certname,
104-
ssl => true,
105-
ssl_cert => "${puppet_ssldir}/certs/${certname}.pem",
106-
ssl_key => "${puppet_ssldir}/private_keys/${certname}.pem",
107-
ssl_chain => "${puppet_ssldir}/ca/ca_crt.pem",
108-
ssl_ca => "${puppet_ssldir}/ca/ca_crt.pem",
109-
ssl_crl => "${puppet_ssldir}/ca/ca_crl.pem",
110-
ssl_protocol => 'ALL -SSLv2 -SSLv3',
111-
ssl_cipher => 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK',
102+
port => $puppet_passenger_port,
103+
priority => '40',
104+
docroot => $puppet_docroot,
105+
serveradmin => $apache_serveradmin,
106+
servername => $certname,
107+
ssl => true,
108+
ssl_cert => "${puppet_ssldir}/certs/${certname}.pem",
109+
ssl_key => "${puppet_ssldir}/private_keys/${certname}.pem",
110+
ssl_chain => "${puppet_ssldir}/ca/ca_crt.pem",
111+
ssl_ca => "${puppet_ssldir}/ca/ca_crt.pem",
112+
ssl_crl => "${puppet_ssldir}/ca/ca_crl.pem",
113+
ssl_protocol => 'ALL -SSLv2 -SSLv3',
114+
ssl_cipher => 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK',
112115
ssl_honorcipherorder => 'On',
113-
ssl_verify_client => 'optional',
114-
ssl_verify_depth => '1',
115-
ssl_options => ['+StdEnvVars', '+ExportCertData'],
116-
rack_base_uris => '/',
117-
directories => [
116+
ssl_verify_client => 'optional',
117+
ssl_verify_depth => '1',
118+
ssl_options => ['+StdEnvVars', '+ExportCertData'],
119+
rack_base_uris => '/',
120+
directories => [
118121
{
119122
path => $puppet_docroot,
120123
},
@@ -123,7 +126,7 @@
123126
options => 'None',
124127
},
125128
],
126-
require => [ File['/etc/puppet/rack/config.ru'], File[$puppet_conf] ],
129+
require => [ File['/etc/puppet/rack/config.ru'], File[$puppet_conf] ],
127130
}
128131

129132
#Hack to add extra passenger configurations for puppetmaster

0 commit comments

Comments
 (0)