X-Git-Url: https://git.adam-barratt.org.uk/?a=blobdiff_plain;f=modules%2Fssl%2Fmanifests%2Finit.pp;h=9d9581b2b60e37ec6209d93d5533ca5d4c0268c3;hb=32af51c0ce0cccd69e4194ca25d17cb562640f55;hp=0ae64aa4ed8f9638377fb5f390fac4a5f3c090cd;hpb=b87d468a5bfc69a0e8390e7484e9bb6d225e404e;p=mirror%2Fdsa-puppet.git diff --git a/modules/ssl/manifests/init.pp b/modules/ssl/manifests/init.pp index 0ae64aa4e..9d9581b2b 100644 --- a/modules/ssl/manifests/init.pp +++ b/modules/ssl/manifests/init.pp @@ -11,17 +11,29 @@ class ssl { ensure => installed, } + if has_role('insecure_ssl') { + $extra_ssl_certs_flags = ' --default' + $ssl_certs_config = 'puppet:///modules/ssl/ca-certificates-global.conf' + } else { + $extra_ssl_certs_flags = '' + $ssl_certs_config = 'puppet:///modules/ssl/ca-certificates.conf' + } + + file { '/etc/ssl/README': + mode => '0444', + source => 'puppet:///modules/ssl/README', + } file { '/etc/ca-certificates.conf': - content => "# This file is under puppet control\n# Only debian.org service certs are trusted, see /etc/ssl/certs/README\n", + source => $ssl_certs_config, notify => Exec['refresh_normal_hashes'], } file { '/etc/ca-certificates-debian.conf': mode => '0444', - content => "# This file is under puppet control\n# Only the CAs for debian.org are trusted, see /etc/ssl/ca-debian/README\nmozilla/AddTrust_External_Root.crt\nmozilla/UTN_USERFirst_Hardware_Root_CA.crt\nspi-inc.org/spi-cacert-2008.crt\n", + source => 'puppet:///modules/ssl/ca-certificates-debian.conf', notify => Exec['refresh_ca_debian_hashes'], } file { '/etc/ca-certificates-global.conf': - content => "# This file is under puppet control\n# All CAs are trusted, see /etc/ssl/ca-global/README\n", + source => 'puppet:///modules/ssl/ca-certificates-global.conf', notify => Exec['refresh_ca_global_hashes'], } @@ -53,27 +65,24 @@ class ssl { purge => true, recurse => true, force => true, - notify => Exec['refresh_normal_hashes'], + notify => [ Exec['refresh_normal_hashes'], Exec['refresh_ca_global_hashes'] ], } file { '/etc/ssl/certs/README': - mode => '0444', - source => 'puppet:///modules/ssl/README.certs', + ensure => absent, } file { '/etc/ssl/ca-debian': ensure => directory, mode => '0755', } file { '/etc/ssl/ca-debian/README': - mode => '0444', - source => 'puppet:///modules/ssl/README.ca-debian', + ensure => absent, } file { '/etc/ssl/ca-global': ensure => directory, mode => '0755', } file { '/etc/ssl/ca-global/README': - mode => '0444', - source => 'puppet:///modules/ssl/README.ca-global', + ensure => absent, } file { '/etc/ssl/debian': ensure => directory, @@ -91,43 +100,57 @@ class ssl { ensure => directory, mode => '0755', } - file { '/etc/ssl/debian/keys': - ensure => directory, - mode => '0750', - group => ssl-cert, - require => Package['ssl-cert'], - } file { '/etc/ssl/debian/certs/thishost.crt': - source => "puppet:///modules/ssl/clientcerts/${::fqdn}.client.crt", + source => "puppet:///modules/ssl/auto-clientcerts/${::fqdn}.client.crt", notify => Exec['refresh_debian_hashes'], } - file { '/etc/ssl/debian/keys/thishost.key': - source => "puppet:///modules/ssl/clientcerts/${::fqdn}.key", - mode => '0440', - group => ssl-cert, - require => Package['ssl-cert'], - } file { '/etc/ssl/debian/certs/ca.crt': - source => 'puppet:///modules/ssl/clientcerts/ca.crt', + source => 'puppet:///modules/ssl/auto-clientcerts/ca.crt', notify => Exec['refresh_debian_hashes'], } file { '/etc/ssl/debian/crls/ca.crl': - source => 'puppet:///modules/ssl/clientcerts/ca.crl', + source => 'puppet:///modules/ssl/auto-clientcerts/ca.crl', } file { '/etc/ssl/debian/certs/thishost-server.crt': - source => "puppet:///modules/exim/certs/${::fqdn}.crt", + source => "puppet:///modules/ssl/auto-certs/${::fqdn}.crt", notify => Exec['refresh_debian_hashes'], } + + file { '/etc/ssl/debian/keys/thishost.key': + ensure => absent, + } file { '/etc/ssl/debian/keys/thishost-server.key': - source => "puppet:///modules/exim/certs/${::fqdn}.key", + ensure => absent, + } + file { '/etc/ssl/debian/keys': + ensure => absent, + force => true, + } + file { '/etc/ssl/private/thishost.key': + source => "puppet:///modules/ssl/auto-clientcerts/${::fqdn}.key", + mode => '0440', + group => ssl-cert, + require => Package['ssl-cert'], + } + file { '/etc/ssl/private/thishost-server.key': + source => "puppet:///modules/ssl/auto-certs/${::fqdn}.key", mode => '0440', group => ssl-cert, require => Package['ssl-cert'], } - file { '/usr/local/sbin/update-ca-certificates-dsa': - mode => '0555', - source => 'puppet:///modules/ssl/update-ca-certificates-dsa', + $updatecacertsdsa = '/usr/local/sbin/update-ca-certificates-dsa' + if (versioncmp($::lsbmajdistrelease, '9') >= 0) { + file { $updatecacertsdsa: + ensure => absent, + } + $updatecacerts = '/usr/sbin/update-ca-certificates' + } else { + file { $updatecacertsdsa: + mode => '0555', + source => 'puppet:///modules/ssl/update-ca-certificates-dsa', + } + $updatecacerts = $updatecacertsdsa } exec { 'retire_debian_links': @@ -141,34 +164,35 @@ class ssl { refreshonly => true, require => Package['openssl'], } + exec { 'refresh_normal_hashes': # NOTE 1: always use update-ca-certificates to manage hashes in # /etc/ssl/certs otherwise /etc/ssl/ca-certificates.crt will # get a hash overriding the hash that would have been generated # for another certificate ... which is problem, comrade # NOTE 2: always ask update-ca-certificates to freshen (-f) the links - command => '/usr/sbin/update-ca-certificates -f', + command => "/usr/sbin/update-ca-certificates --fresh${extra_ssl_certs_flags}", refreshonly => true, require => Package['ca-certificates'], } exec { 'refresh_ca_debian_hashes': - command => '/usr/local/sbin/update-ca-certificates-dsa --fresh --certsconf /etc/ca-certificates-debian.conf --localcertsdir /dev/null --etccertsdir /etc/ssl/ca-debian --hooksdir /dev/null', + command => "${updatecacerts} --fresh --certsconf /etc/ca-certificates-debian.conf --localcertsdir /dev/null --etccertsdir /etc/ssl/ca-debian --hooksdir /dev/null", refreshonly => true, require => [ Package['ca-certificates'], File['/etc/ssl/ca-debian'], File['/etc/ca-certificates-debian.conf'], - File['/usr/local/sbin/update-ca-certificates-dsa'], + File[$updatecacertsdsa], ] } exec { 'refresh_ca_global_hashes': - command => '/usr/local/sbin/update-ca-certificates-dsa --fresh --default --certsconf /etc/ca-certificates-global.conf --etccertsdir /etc/ssl/ca-global --hooksdir /dev/null', + command => "${updatecacerts} --fresh --default --certsconf /etc/ca-certificates-global.conf --etccertsdir /etc/ssl/ca-global --hooksdir /dev/null", refreshonly => true, require => [ Package['ca-certificates'], File['/etc/ssl/ca-global'], File['/etc/ca-certificates-global.conf'], - File['/usr/local/sbin/update-ca-certificates-dsa'], + File[$updatecacertsdsa], ] }