modules/stunnel4/manifests/init.pp

   1 class stunnel4 {
   2     define stunnel_generic($client, $verify, $cafile, $crlfile=false, $accept, $connect, $local=false) {
   3         file {
   4             "/etc/stunnel":
   5                 ensure  => directory,
   6                 owner   => root,
   7                 group   => root,
   8                 mode    => 755,
   9                 ;
  10             "/etc/stunnel/puppet-${name}.conf":
  11                 content => template("stunnel4/stunnel.conf.erb"),
  12                 notify  => Exec['restart_stunnel'],
  13                 ;
  14             "/etc/init.d/stunnel4":
  15                 source => "puppet:///modules/stunnel4/etc-init.d-stunnel4",
  16             ;
  17         }
  18     }
  19
  20     # define an stunnel listener, listening for SSL connections on $accept,
  21     # connecting to plaintext service $connect using local source address $local
  22     #
  23     # unfortunately stunnel is really bad about verifying its peer,
  24     # all we can be certain of is that they are signed by our CA,
  25     # not who they are.  So do not use in places where the identity of
  26     # the caller is important.  Use dsa-portforwarder for that.
  27     define stunnel_server($accept, $connect, $local = "127.0.0.1") {
  28         stunnel_generic {
  29             "${name}":
  30                 client => false,
  31                 verify => 2,
  32                 cafile => "/etc/exim4/ssl/ca.crt",
  33                 crlfile => "/etc/exim4/ssl/crl.crt",
  34                 accept => "${accept}",
  35                 connect => "${connect}",
  36                 ;
  37         }
  38         @ferm::rule {
  39             "stunnel-${name}":
  40                 description => "stunnel ${name}",
  41                 rule => "&SERVICE_RANGE(tcp, ${accept}, \$HOST_DEBIAN_V4)",
  42                 ;
  43             "stunnel-${name}-v6":
  44                 domain          => 'ip6',
  45                 description => "stunnel ${name}",
  46                 rule => "&SERVICE_RANGE(tcp, ${accept}, \$HOST_DEBIAN_V6)",
  47                 ;
  48         }
  49     }
  50     define stunnel_client($accept, $connecthost, $connectport) {
  51         file {
  52             "/etc/stunnel/puppet-${name}-peer.pem":
  53                 # source  => "puppet:///modules/exim/certs/${connecthost}.crt",
  54                 content => generate("/bin/cat", "/etc/puppet/modules/exim/files/certs/${connecthost}.crt",
  55                                                 "/etc/puppet/modules/exim/files/certs/ca.crt"),
  56                 notify  => Exec['restart_stunnel'],
  57                 ;
  58         }
  59         stunnel_generic {
  60             "${name}":
  61                 client => true,
  62                 verify => 3,
  63                 cafile => "/etc/stunnel/puppet-${name}-peer.pem",
  64                 accept => "${accept}",
  65                 connect => "${connecthost}:${connectport}",
  66                 ;
  67         }
  68     }
  69
  70
  71     package {
  72         "stunnel4": ensure => installed;
  73     }
  74
  75     file {
  76         "/etc/stunnel/stunnel.conf":
  77             ensure => absent,
  78             require => [ Package['stunnel4'] ],
  79             ;
  80     }
  81
  82     exec {
  83         "enable_stunnel4":
  84                 command => "sed -i -e 's/^ENABLED=/#&/; \$a ENABLED=1 # added by puppet' /etc/default/stunnel4",
  85                 unless => "grep -q '^ENABLED=1' /etc/default/stunnel4",
  86                 require => [ Package['stunnel4'] ],
  87                 ;
  88         "restart_stunnel":
  89                 command => "true && cd / && env -i /etc/init.d/stunnel4 restart",
  90                 require => [ File['/etc/stunnel/stunnel.conf'], Exec['enable_stunnel4'], Package['stunnel4'] ],
  91                 refreshonly => true,
  92                 ;
  93     }
  94 }
  95
  96 # vim:set et:
  97 # vim:set sts=4 ts=4:
  98 # vim:set shiftwidth=4: