Disable the usual SSL setup for godard

[mirror/dsa-puppet.git] / modules / ssl / manifests / init.pp

diff --git a/modules/ssl/manifests/init.pp b/modules/ssl/manifests/init.pp
index 127869a..756661e 100644 (file)
--- a/modules/ssl/manifests/init.pp
+++ b/modules/ssl/manifests/init.pp
@@ -11,17 +11,21 @@ class ssl {
                ensure   => installed,
        }
 
+       file { '/etc/ssl/README':
+               mode   => '0444',
+               source => 'puppet:///modules/ssl/README',
+       }
        file { '/etc/ca-certificates.conf':
-               content => "# This file is under puppet control\n# Only debian.org service certs are trusted, see /etc/ssl/certs/README",
+               source => 'puppet:///modules/ssl/ca-certificates.conf',
                notify  => Exec['refresh_normal_hashes'],
        }
        file { '/etc/ca-certificates-debian.conf':
                mode    => '0444',
-               content => "# This file is under puppet control\n# Only the CAs for debian.org are trusted, see /etc/ssl/ca-debian/README\nmozilla/AddTrust_External_Root.crt",
+               source => 'puppet:///modules/ssl/ca-certificates-debian.conf',
                notify  => Exec['refresh_ca_debian_hashes'],
        }
        file { '/etc/ca-certificates-global.conf':
-               content => "# This file is under puppet control\n# All CAs are trusted, see /etc/ssl/ca-global/README",
+               source => 'puppet:///modules/ssl/ca-certificates-global.conf',
                notify  => Exec['refresh_ca_global_hashes'],
        }
 
@@ -53,27 +57,24 @@ class ssl {
                purge    => true,
                recurse  => true,
                force    => true,
-               notify   => Exec['refresh_normal_hashes'],
+               notify   => [ Exec['refresh_normal_hashes'], Exec['refresh_ca_global_hashes'] ],
        }
        file { '/etc/ssl/certs/README':
-               mode   => '0444',
-               source => 'puppet:///modules/ssl/README.certs',
+               ensure => absent,
        }
        file { '/etc/ssl/ca-debian':
                ensure => directory,
                mode   => '0755',
        }
        file { '/etc/ssl/ca-debian/README':
-               mode   => '0444',
-               source => 'puppet:///modules/ssl/README.ca-debian',
+               ensure => absent,
        }
        file { '/etc/ssl/ca-global':
                ensure => directory,
                mode   => '0755',
        }
-       file { '/etc/ssl/ca-debian/README':
-               mode   => '0444',
-               source => 'puppet:///modules/ssl/README.ca-global',
+       file { '/etc/ssl/ca-global/README':
+               ensure => absent,
        }
        file { '/etc/ssl/debian':
                ensure   => directory,
@@ -91,22 +92,10 @@ class ssl {
                ensure  => directory,
                mode    => '0755',
        }
-       file { '/etc/ssl/debian/keys':
-               ensure  => directory,
-               mode    => '0750',
-               group   => ssl-cert,
-               require => Package['ssl-cert'],
-       }
        file { '/etc/ssl/debian/certs/thishost.crt':
                source  => "puppet:///modules/ssl/clientcerts/${::fqdn}.client.crt",
                notify  => Exec['refresh_debian_hashes'],
        }
-       file { '/etc/ssl/debian/keys/thishost.key':
-               source  => "puppet:///modules/ssl/clientcerts/${::fqdn}.key",
-               mode    => '0440',
-               group   => ssl-cert,
-               require => Package['ssl-cert'],
-       }
        file { '/etc/ssl/debian/certs/ca.crt':
                source  => 'puppet:///modules/ssl/clientcerts/ca.crt',
                notify  => Exec['refresh_debian_hashes'],
@@ -118,16 +107,42 @@ class ssl {
                source  => "puppet:///modules/exim/certs/${::fqdn}.crt",
                notify  => Exec['refresh_debian_hashes'],
        }
+
+       file { '/etc/ssl/debian/keys/thishost.key':
+               ensure => absent,
+       }
        file { '/etc/ssl/debian/keys/thishost-server.key':
+               ensure => absent,
+       }
+       file { '/etc/ssl/debian/keys':
+               ensure => absent,
+               force    => true,
+       }
+       file { '/etc/ssl/private/thishost.key':
+               source  => "puppet:///modules/ssl/clientcerts/${::fqdn}.key",
+               mode    => '0440',
+               group   => ssl-cert,
+               require => Package['ssl-cert'],
+       }
+       file { '/etc/ssl/private/thishost-server.key':
                source  => "puppet:///modules/exim/certs/${::fqdn}.key",
                mode    => '0440',
                group   => ssl-cert,
                require => Package['ssl-cert'],
        }
 
-       file { '/usr/local/sbin/update-ca-certificates-dsa':
-               mode   => '0555',
-               source => 'puppet:///modules/ssl/update-ca-certificates-dsa',
+       $updatecacertsdsa = '/usr/local/sbin/update-ca-certificates-dsa'
+       if (versioncmp($::lsbmajdistrelease, '9') >= 0) {
+               file { $updatecacertsdsa:
+                       ensure => absent,
+               }
+               $updatecacerts = '/usr/sbin/update-ca-certificates'
+       } else {
+               file { $updatecacertsdsa:
+                       mode   => '0555',
+                       source => 'puppet:///modules/ssl/update-ca-certificates-dsa',
+               }
+               $updatecacerts = $updatecacertsdsa
        }
 
        exec { 'retire_debian_links':
@@ -141,34 +156,40 @@ class ssl {
                refreshonly => true,
                require     => Package['openssl'],
        }
+       if $::hostname == 'godard' {
+               $extra_ssl_certs_flags = ' --default'
+       } else {
+               $extra_ssl_certs_flags = ''
+       }
+
        exec { 'refresh_normal_hashes':
                # NOTE 1: always use update-ca-certificates to manage hashes in
                #         /etc/ssl/certs otherwise /etc/ssl/ca-certificates.crt will
                #         get a hash overriding the hash that would have been generated
                #         for another certificate ... which is problem, comrade
                # NOTE 2: always ask update-ca-certificates to freshen (-f) the links
-               command     => '/usr/sbin/update-ca-certificates -f',
+               command     => "/usr/sbin/update-ca-certificates --fresh${extra_ssl_certs_flags}",
                refreshonly => true,
                require     => Package['ca-certificates'],
        }
        exec { 'refresh_ca_debian_hashes':
-               command     => '/usr/local/sbin/update-ca-certificates-dsa --fresh --certsconf /etc/ca-certificates-debian.conf --localcertsdir /dev/null --etccertsdir /etc/ssl/ca-debian --hooksdir /dev/null',
+               command     => "${updatecacerts} --fresh --certsconf /etc/ca-certificates-debian.conf --localcertsdir /dev/null --etccertsdir /etc/ssl/ca-debian --hooksdir /dev/null",
                refreshonly => true,
                require     => [
                        Package['ca-certificates'],
                        File['/etc/ssl/ca-debian'],
                        File['/etc/ca-certificates-debian.conf'],
-                       File['/usr/local/sbin/update-ca-certificates-dsa'],
+                       File[$updatecacertsdsa],
                ]
        }
        exec { 'refresh_ca_global_hashes':
-               command     => '/usr/local/sbin/update-ca-certificates-dsa --fresh --default --certsconf /etc/ca-certificates-global.conf --etccertsdir /etc/ssl/ca-global --hooksdir /dev/null',
+               command     => "${updatecacerts} --fresh --default --certsconf /etc/ca-certificates-global.conf --etccertsdir /etc/ssl/ca-global --hooksdir /dev/null",
                refreshonly => true,
                require     => [
                        Package['ca-certificates'],
                        File['/etc/ssl/ca-global'],
                        File['/etc/ca-certificates-global.conf'],
-                       File['/usr/local/sbin/update-ca-certificates-dsa'],
+                       File[$updatecacertsdsa],
                ]
        }