Try to add openpgpkey zone

[mirror/dsa-puppet.git] / modules / roles / manifests / keyring.pp

diff --git a/modules/roles/manifests/keyring.pp b/modules/roles/manifests/keyring.pp
index eb331e0..cafad2b 100644 (file)
--- a/modules/roles/manifests/keyring.pp
+++ b/modules/roles/manifests/keyring.pp
@@ -1,10 +1,36 @@
 class roles::keyring {
        rsync::site { 'keyring':
-               source => 'puppet:///modules/roles/keyring/rsyncd.conf',
+               source  => 'puppet:///modules/roles/keyring/rsyncd.conf',
+               sslname => 'keyring.debian.org',
        }
 
        ssl::service { 'keyring.debian.org':
-               notify => Service['apache2'],
-               key => true,
+               notify   => Exec['service apache2 reload'],
+               key      => true,
+               tlsaport => [443, 1873],
        }
+
+       include named::authoritative
+
+       $notify_address = join(getfromhash($site::allnodeinfo, 'denis.debian.org', 'ipHostNumber'), "; ")
+
+       concat::fragment { 'dsa-named-conf-puppet-misc---openpgpkey-zone':
+               target => '/etc/bind/named.conf.puppet-misc',
+               order  => '020',
+               content  => @("EOF"),
+                       zone "_openpgpkey.debian.org" {
+                               type master;
+                                       file "/srv/keyring.debian.org/_openpgpkey.debian.org.zone";
+                                       allow-query { any; };
+                                       allow-transfer {
+                                               key tsig-denis.debian.org-kaufmann.debian.org ;
+                                               127.0.0.1;
+                                       };
+                                       also-notify {
+                                               $notify_address;
+                                       };
+                       }
+                       | EOF
+       }
+
 }