Skip to content

Commit b74f62c

Browse files
ehelmsekohl
authored andcommitted
Ensure hostname directory exists when copying server cert
1 parent 91651c5 commit b74f62c

File tree

4 files changed

+99
-0
lines changed

4 files changed

+99
-0
lines changed

manifests/apache.pp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -72,6 +72,16 @@
7272
$apache_cert_path = "${certs::ssl_build_dir}/${hostname}/${apache_cert_name}"
7373

7474
if $server_cert {
75+
ensure_resource(
76+
'file',
77+
"${certs::ssl_build_dir}/${hostname}",
78+
{
79+
'ensure' => directory,
80+
'owner' => 'root',
81+
'group' => 'root',
82+
'mode' => '0750',
83+
}
84+
)
7585
file { "${apache_cert_path}.crt":
7686
ensure => file,
7787
source => $server_cert,

manifests/foreman_proxy.pp

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -40,6 +40,16 @@
4040
$proxy_cert_path = "${certs::ssl_build_dir}/${hostname}/${proxy_cert_name}"
4141

4242
if $server_cert {
43+
ensure_resource(
44+
'file',
45+
"${certs::ssl_build_dir}/${hostname}",
46+
{
47+
'ensure' => directory,
48+
'owner' => 'root',
49+
'group' => 'root',
50+
'mode' => '0750',
51+
}
52+
)
4353
file { "${proxy_cert_path}.crt":
4454
ensure => file,
4555
source => $server_cert,

spec/acceptance/apache_spec.rb

Lines changed: 42 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -131,4 +131,46 @@ class { 'certs::apache':
131131
it { should_not exist }
132132
end
133133
end
134+
135+
context 'with custom certificates fresh' do
136+
before(:context) do
137+
['crt', 'key'].each do |ext|
138+
source_path = "fixtures/example.partial.solutions.#{ext}"
139+
dest_path = "/server.#{ext}"
140+
scp_to(hosts, source_path, dest_path)
141+
end
142+
143+
on hosts, 'rm -rf /root/ssl-build'
144+
end
145+
146+
it_behaves_like 'an idempotent resource' do
147+
let(:manifest) do
148+
<<-PUPPET
149+
class { '::certs::apache':
150+
server_cert => '/server.crt',
151+
server_key => '/server.key',
152+
}
153+
PUPPET
154+
end
155+
end
156+
157+
describe x509_certificate('/etc/pki/katello/certs/katello-apache.crt') do
158+
it { should be_certificate }
159+
# Doesn't have to be valid - can be expired since it's a static resource
160+
it { should have_purpose 'server' }
161+
its(:issuer) { should match_without_whitespace(/CN = Fake LE Intermediate X1/) }
162+
its(:subject) { should match_without_whitespace(/CN = example.partial.solutions/) }
163+
its(:keylength) { should be >= 2048 }
164+
end
165+
166+
describe x509_private_key('/etc/pki/katello/private/katello-apache.key') do
167+
it { should_not be_encrypted }
168+
it { should be_valid }
169+
it { should have_matching_certificate('/etc/pki/katello/certs/katello-apache.crt') }
170+
end
171+
172+
describe package("#{fact('fqdn')}-apache") do
173+
it { should_not be_installed }
174+
end
175+
end
134176
end

spec/acceptance/foreman_proxy_spec.rb

Lines changed: 37 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -162,6 +162,43 @@
162162
end
163163
end
164164

165+
context 'with custom certificates fresh' do
166+
before(:context) do
167+
['crt', 'key'].each do |ext|
168+
source_path = "fixtures/example.partial.solutions.#{ext}"
169+
dest_path = "/server.#{ext}"
170+
scp_to(hosts, source_path, dest_path)
171+
end
172+
173+
on hosts, 'rm -rf /root/ssl-build'
174+
end
175+
176+
it_behaves_like 'an idempotent resource' do
177+
let(:manifest) do
178+
<<-PUPPET
179+
class { '::certs::foreman_proxy':
180+
server_cert => '/server.crt',
181+
server_key => '/server.key',
182+
}
183+
PUPPET
184+
end
185+
end
186+
187+
describe x509_certificate('/etc/foreman-proxy/ssl_cert.pem') do
188+
it { should be_certificate }
189+
# Doesn't have to be valid - can be expired since it's a static resource
190+
it { should have_purpose 'server' }
191+
its(:issuer) { should match_without_whitespace(/CN = Fake LE Intermediate X1/) }
192+
its(:subject) { should match_without_whitespace(/CN = example.partial.solutions/) }
193+
its(:keylength) { should be >= 2048 }
194+
end
195+
196+
describe x509_private_key('/etc/foreman-proxy/ssl_key.pem') do
197+
it { should_not be_encrypted }
198+
it { should have_matching_certificate('/etc/foreman-proxy/ssl_cert.pem') }
199+
end
200+
end
201+
165202
context 'with deploy false' do
166203
before(:context) do
167204
on default, 'rm -rf /root/ssl-build /etc/foreman-proxy'

0 commit comments

Comments
 (0)