modules/stunnel4/manifests/init.pp

   1 class stunnel4 {
   2     define stunnel_generic($client, $verify, $cafile, $crlfile=false, $accept, $connect, $local=false) {
   3         file {
   4             "/etc/stunnel/puppet-${name}.conf":
   5                 content => template("stunnel4/stunnel.conf.erb"),
   6                 notify  => Exec['restart_stunnel'],
   7                 ;
   8         }
   9     }
  10
  11     # define an stunnel listener, listening for SSL connections on $accept,
  12     # connecting to plaintext service $connect using local source address $local
  13     #
  14     # unfortunately stunnel is really bad about verifying its peer,
  15     # all we can be certain of is that they are signed by our CA,
  16     # not who they are.  So do not use in places where the identity of
  17     # the caller is important.  Use dsa-portforwarder for that.
  18     define stunnel_server($accept, $connect, $local = "127.0.0.1") {
  19         stunnel_generic {
  20             "${name}":
  21                 client => false,
  22                 verify => 2,
  23                 cafile => "/etc/exim4/ssl/ca.crt",
  24                 crlfile => "/etc/exim4/ssl/crl.crt",
  25                 accept => "${accept}",
  26                 connect => "${connect}",
  27                 ;
  28         }
  29         @ferm::rule {
  30             "stunnel-${name}":
  31                 description => "stunnel ${name}",
  32                 rule => "&SERVICE_RANGE(tcp, ${accept}, \$HOST_DEBIAN_V4)",
  33                 ;
  34             "stunnel-${name}-v6":
  35                 domain          => 'ip6',
  36                 description => "stunnel ${name}",
  37                 rule => "&SERVICE_RANGE(tcp, ${accept}, \$HOST_DEBIAN_V6)",
  38                 ;
  39         }
  40     }
  41     define stunnel_client($accept, $connecthost, $connectport) {
  42         file {
  43             "/etc/stunnel/puppet-${name}-peer.pem":
  44                 # source  => "puppet:///modules/exim/certs/${connecthost}.crt",
  45                 content => generate("/bin/cat", "/etc/puppet/modules/exim/files/certs/${connecthost}.crt",
  46                                                 "/etc/puppet/modules/exim/files/certs/ca.crt"),
  47                 notify  => Exec['restart_stunnel'],
  48                 ;
  49         }
  50         stunnel_generic {
  51             "${name}":
  52                 client => true,
  53                 verify => 3,
  54                 cafile => "/etc/stunnel/puppet-${name}-peer.pem",
  55                 accept => "${accept}",
  56                 connect => "${connecthost}:${connectport}",
  57                 require => [ File["/etc/stunnel/puppet-${name}-peer.pem"] ],
  58                 ;
  59         }
  60     }
  61
  62
  63     package {
  64         "stunnel4": ensure => installed;
  65     }
  66
  67     file {
  68         "/etc/stunnel/stunnel.conf":
  69             ensure => absent,
  70             require => [ Package['stunnel4'] ],
  71             ;
  72     }
  73
  74     exec {
  75         "enable_stunnel4":
  76                 command => "sed -i -e 's/^ENABLED=/#&/; \$a ENABLED=1 # added by puppet' /etc/default/stunnel4",
  77                 unless => "grep -q '^ENABLED=1' /etc/default/stunnel4",
  78                 require => [ Package['stunnel4'] ],
  79                 ;
  80         "restart_stunnel":
  81                 command => "true && cd / && env -i /etc/init.d/stunnel4 restart",
  82                 require => [ File['/etc/stunnel/stunnel.conf'], Exec['enable_stunnel4'], Package['stunnel4'] ],
  83                 refreshonly => true,
  84                 ;
  85     }
  86 }
  87
  88 # vim:set et:
  89 # vim:set sts=4 ts=4:
  90 # vim:set shiftwidth=4: