X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Frsync%2Fmanifests%2Fsite.pp;h=ec4a09ecc418e6c2e10893dfbb91d05ecf516ff4;hb=905a45aa54d0bb8e0c0930d4c2e6bfed95abb72b;hp=97dbb05d872f40139c6ba6777c58cc9ab30d0fad;hpb=94eb0fe06f5deafe086b3f6f18bfd5aab2a6e069;p=mirror%2Fdsa-puppet.git diff --git a/modules/rsync/manifests/site.pp b/modules/rsync/manifests/site.pp index 97dbb05d8..ec4a09ecc 100644 --- a/modules/rsync/manifests/site.pp +++ b/modules/rsync/manifests/site.pp @@ -69,7 +69,8 @@ define rsync::site ( if $sslname != '' { file { "/etc/rsyncd-${name}-stunnel.conf": - content => template('rsync/rsyncd-stunnel.conf.erb') + content => template('rsync/rsyncd-stunnel.conf.erb'), + require => File["/etc/ssl/debian/certs/${sslname}.crt-chained"], } @ferm::rule { "rsync-${name}-ssl": domain => '(ip ip6)', @@ -102,6 +103,13 @@ define rsync::site ( require => File["/etc/rsyncd-${name}-stunnel.conf"], } } + + dnsextras::tlsa_record{ "tlsa-${sslname}-${sslport}": + zone => 'debian.org', + certfile => [ "/etc/puppet/modules/ssl/files/servicecerts/${sslname}.crt", "/etc/puppet/modules/ssl/files/from-letsencrypt/${sslname}.crt" ], + port => $sslport, + hostname => "$sslname", + } } Service['rsync']->Service['xinetd']